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OMG's unlikely model citizen: 
Microsoft shifts UML gears 



BY DAVID WORTHINGTON 

In a course reversal that under- 
scores its commitment to model- 
driven development (MDD), 
Microsoft has joined Object 
Management Group. 




Muglia: Models make IT more dynamic. 



OMG is the nonprofit consor- 
tium that oversees Business 
Process Management Notation 
and the Unified Modeling Lan- 
guage. As recently as 2006, 
Microsoft had refused to endorse 
UML, saying the language was 
"too general." 

Microsoft's position evolved 
after the October 2007 
announcement of its "Oslo" ini- 
tiative, a multiyear effort to 
develop technology that helps 
customers build, deploy, design 
and manage composite applica- 
tions. The primary objective is to 
take MDD into the application 
development mainstream. 

In a June interview, Steven 



Martin, director of product man- 
agement in Microsoft's connect- 
ed systems division, said the 
company was developing an 
XML-based foundational model- 
ing language that would be inter- 
operable with domain-specific 
modeling languages as well as 
with Business Process Execution 
Language and UML. 

Microsoft has said it will stan- 
dardize that language, which, 
according to Martin, it will detail 
at the Professional Developers 
Conference in Los Angeles at the 
end of this month. 

"They are altering their tack," 

Jeffrey Hammond, a senior 

continued on page 29 ► 



Giving back to open source 

Donating code? Here's how to avoid returns 



BY ALEX HANDY 

Contributing code to an open- 
source community can be like 
giving a gift when you don't know 
the cultural rules: There's always 
a chance your basket of code 
won't be accepted. At the same 
time, fresh open-source projects 
can wither on the vine if not 
properly tended. Therefore, it is 
prudent for enterprise develop- 
ers to set a clear path, both in 
and out, for code of all kinds. 

"First, you have to get a han- 
dle on your own internal require- 
ments," said Peter Vescuso, 
senior vice president of market- 
ing and business development 




at Black Duck. 
"What kind of 
policies are you 
going to have inter- 
nally around use 
and giving back?" 

Once a policy is in 
place, there are various 
levels of contribution to 
consider. "We always think 
about multiple levels of con- 
tributions and ways of contribut- 
ing," said Ian Skerrett, director of 
marketing with the Eclipse Foun- 
dation. "At a basic level, there are 
things like opening bugs or 
adding new feature requests. 
That, at a basic level, is still very 




valuable to 
the community. Of 
course, an even better bug is 
a bug with a patch to it." 

Eclipse has a large number of 
corporate code donors, but Sker- 
rett said that many of the e-mail 
addresses seen in the project's 
Bugzilla database are from 
places like Hotmail and Gmail, 
continued on page 26 ► 




The SDL threat modeler determines where an app may need added security. 

Microsoft shares security 
life cycle expertise, tooling 



BY DAVID WORTHINGTON 

From ILOVEYOU to Code Red, 
Microsoft faced an onslaught of 
security exploits at the onset of 
the decade. Taking those events 
as a wakeup call, it changed its 
approach to security, adopting a 
security development life cycle 
(SDL) and creating an internal 
threat modeler. 

Now, Microsoft is launching 
programs to take its SDL experi- 
ence to its customers, and will 
offer tooling to help organiza- 
tions review the design and 
implementation of their software 
in order to determine require- 
ments for security features. 

Threat modeling processes 
have been in use at Microsoft 
since 1999, and the threat model- 
ing tool is a core element of the 
SDL, said Adam Shostack, senior 
product manager for the tool. 
Microsoft's objective is to trans- 
form threat modeling from an 



expert-led process into one that 
any software architect can per- 
form effectively, he said. 

"We looked to develop a 
process built around things typical 
software engineers understand — 
they will know how their software 
is actually built," Shostack said. 
The tool contains a bug reporting 
feature so developers can treat 
security vulnerabilities the same 
way that they already deal with 
defects and features, he said. 

The tool is designed to inte- 
grate threat modeling as a 
springboard for other phases of 
the SDL, Shostack said. "It push- 
es people to use the threat mod- 
el as a driver for the entire secu- 
rity development process." 

It is not rigid, however. Users 
can choose not to model certain 
threats, Shostack said, by select- 
ing those elements that they 
don't believe pose a tampering 
continued on page 28 ► 
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unified change management 

Conclave: IT, development must merge processes 



BY ALEX HANDY 

To an outsider, it might seem 
that IT and development folks 
are cut from the same wood. 
But those who've worked on 
either side of the fence know 
that the lines of communica- 
tions between those who write 
the software and those who 
run it can break down without 
proper processes in place. 

At the recent IT Service 
Management Fusion confer- 
ence in San Francisco, much of 
the discussion centered on just 
how to bring IT and develop- 
ment goals closer together. 

At the heart of the debate is 
change management. With IT 
and development teams track- 
ing their own change schedules, 
it can be difficult to merge the 
two. But merge they must, said 
Richard Hawkins, director of 
IT service management con- 
sulting at Pepperweed, a 
nationwide consulting firm. 
Hawkins said he's seen numer- 
ous organizations in the field 
where the developers and the 
IT managers don't get along. 

"There's a large retail chain 
in the Seattle area [with] about 
80 stores across the country. 
One day, they made an IT 
change: moving an application 
into production on the first day 
of one of the company's two 
yearly five-day sales. It brought 
the entire system to its knees, 
and for four hours they could- 
n't process any transactions. 
The business said to IT, Tf you 
do that again, we outsource all 
of you.' Since then, they have 
implemented one of the pre- 
mier change management sys- 
tems I've seen," said Hawkins. 

That new system treats 
change schedules from all 
sources as calendar items, he 
said. When a major software 
change is in the pipeline, an 



exact date is set ahead of time 
for the rollout. The company's 
Web 2.0-like calendaring and 
resource planning systems are 
all aware of this date, and they 
keep it visible. Thus, when 
change time comes, everyone 
in the company is ready. 

John Collier, Bank of 
America senior vice president 
of IT strategy and architec- 
ture, said the real danger of 
change is the unquantifiable 
factor of the people involved. 
Collier recently became a 
Bank of America employee 
when his former employer, 
Countrywide, was acquired. 

He said that many organi- 
zations don't take into account 
"the emotion of change. 
Change is, many times, viewed 
by individuals as a threat to 
their well-being. Structured 
organization change manage- 
ment can mitigate the uncer- 
tainty. Make sure people 
change and evolve with the IT 
services over time. 

"We monitor system avail- 
ability, but what about people 
availability? We lose a lot of 
productivity because people 
don't know where they fit in in 
the new structure. IT doesn't 
have to be so reactive." 

TRAINING AND TALKING 

When that change comes from 
a software update, Pepper- 
weed's Hawkins said, develop- 
ment teams may want to con- 
sider a much longer time scale 
for managing the update. 
That's because the folks who 
wrote the software are the 
ones most qualified to train 
others in its use. 

"How do I need to train the 
end users? How do I train the 
operating staff? How am I 
going to handle that initial 90 
days of support?" asked 



Hawkins. "Can I take some of 
that development team and 
move them into production for 
the first 90 days? That's what 
I'd call 'best practice.' It's 
rarely what I see." 

Another area where IT and 
development teams tend to 
have a disconnect is testing, said 
Hawkins. "IT does a really good 
job of unit testing, and typically 
after unit testing they're throw- 
ing it over the fence. Some IT 
departments do user accep- 
tance testing, but rarely are 
they doing regression testing. 
Does it hog all the bandwidth? 
Does it work on my workstation 
builds? Those are the kinds of 
things ... that are just missing, 
because [such test] is expensive 
to do," said Hawkins. 

Bank of America's Collier 
said the SaaS model can relieve 
some of the disconnect be- 
tween IT and the rest of an 
organization. "Many of the 
emotions felt by individuals 
affected by change can be 
improved through a service- 
oriented model," he said. 

But that requires proper 
architecture and a continuing 
dialog between operations and 
development. "Your applica- 
tion development crew is typi- 
cally a separate division or 
practice within IT," said Pep- 
perweed's Hawkins. "During 
your initial requirements 
analysis, the operations engi- 
neer needs to be at the table so 
he can give the requirements 
for how it has to be monitored, 
how they want batch control 
run, what level of automation 
needs to be put into it." 

To that end, Pepperweed 
has placed a series of 21 best 
practices and diagrams for how 
workflow should function in an 
organization. It's available free 
at pepperweed.com. I 



'Nitro' boosts Curl 
for enterprise RIAs 



BY JEFF FEINMAN 

Curl, angling to be the go-to 
platform for enterprise-class 
rich Internet application (RIA) 
development, rolled out a new 
beta of its platform at the Web 
2.0 Expo in New York City. 

"Curl Nitro," the code name 
of the beta 2 release of Curl 7.0, 
comes with a new security model 
for applications, Curl executives 
said. Administrators can allow 
and disallow end-user privileges, 
and unprivileged applications 
can store data on a local disk. 

"The security model allows 
you to have local storage on the 
desktop," said Richard Tread- 
way, vice president of market- 
ing and product strategy. "You 
can do it in a protected sand- 
box, or you can interface to the 
SQLite database. Neither of 
those require the application to 
run privileged, which is an 
important feature." 

Curl has positioned its prod- 
uct as an enterprise-class RIA 
platform, and Treadway said 
Curl provides the appropriate 
"horsepower" for behind-the- 
firewall enterprise applications. 
AJAX is suited for minimal 
client processing and website 
functions such as retail pur- 
chases, Treadway said, but Curl 
has performance advantages 
over platforms such as Flex and 
AJAX because Curl's runtime 
environment quickly compiles 
the application to the client 
hardware. Once the application 
is compiled, it's running native- 
ly on the client, boosting per- 
formance, Treadway said. 

"That's one of the reasons 
that we get higher performance 
on manipulation of data sets on 
the client than Flex [does]," 
Treadway said. "In many cases, 
AJAX can't even load the size of 
the data set. In experiments 
we've done, we've scaled 
100,000 records, and the load 
time is significantly faster when 
manipulating the data on the 
client. 

"We've also done lots of 
optimizations, including the 
size of the applications as 
they're downloaded. We have a 
compression and encryption 
[approach] for Curl applica- 
tions that makes them substan- 
tially smaller when they're ini- 
tially invoked." 



The beta 2 version of Curl 
7.0, available now for download, 
has a new applet installer that 
installs Curl applets for offline 
operation. Dialog boxes in 
Curl's administrative console let 
the user administer the applica- 
tion, according to the company. 

Curl 7.0 focuses on making 
it easier to create desktop appli- 
cations. Previous versions of 
Curl used obscure user inter- 
faces, Treadway said, so the 
company has cleaned up appli- 
cation development and instal- 
lation in version 7.0. Applica- 
tions created on the Curl 
platform run outside the brows- 
er on Curl's runtime environ- 
ment and can be installed on 
the desktop or the client 
machine. When the application 
is started up, it checks the Web 
to see if there's a newer version 
of the application available. 

CIRCUITOUS PATH 

Curl has undergone a string of 
ownership and management 
changes since its 1998 founding 
by researchers from the Massa- 
chusetts Institute of Technolo- 
gy, including Tim Berners-Lee, 
inventor of the Web and direc- 
tor of the World Wide Web 
Consortium. Treadway said 
Berners-Lee and Curl's other 
founders realized they wouldn't 
be able to provide a platform 
for creating Web applications 
with HTML. As a result, they 
invented the Curl language, 
which combines HTML, script- 
ing and object-oriented pro- 
gramming in one environment. 

The company released its 
first product in 2002. "The tim- 
ing wasn't the best," Treadway 
said. "The company rode the 
dot-com wave, going through 
quite a bit of investment capital 
and ending up with quite a bit 
of success in Japan." 

Sumisho Computer Sys- 
tems, one of Curl's Japanese 
distributors, purchased the 
company in 2004 and took it out 
of the U.S. market. Sumisho 
had closed big deals in Japan 
with such giants as Toyota, Sony 
and Panasonic, Treadway said, 
and had purchased Curl to pro- 
tect those investments. 

With the resurgence of RIAs 
in 2007, Curl reentered the 
U.S. market. I 




ALTERNATIVE JINKING ABOUT APPLlCATI 
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Alternative thinking is attacking your own Web applications, finding 
vulnerabilities and destroying them with precision and vengeance — 
throug hout the life of the app I i cation . 

It's looking at application security through the eyes of a hacker 
to identify threats to your system and risks to your business. 

it's harnessing the power of SPI Dynamics, recently acquired by HP, 
to redefine and expand your security abilities. (Please note: positive 
effects on your bottom line J 

It's assessing security the right way, from development to QA 
to operations — without slowing down the business. 

(Cue elated cheers.) 



Technotagy for better business outcomes. 
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Office 2.0 opens Web 2.0 for business 

Conference highlights social networking, Ul design, ubiquitous computing 



BY ALEX HANDY 

The use of collaborative Web 
technologies to increase pro- 
ductivity gains and business 
agility came into focus at the 
third annual Office 2.0 confer- 
ence. Talks at the event includ- 
ed a spirited discussion of user 
interface design and a presenta- 
tion on the business lessons 
General Electric learned as it 
built an internal social network. 

The first day of Office 2.0, 
held last month in San Francis- 
co, was an un-conference, with 
dynamically designed sessions 
focused on audience participa- 
tion. Steve Bristol, co-founder of 
Lesseverything.com, led a talk 
on user interface design that dis- 
cussed everything from Apple to 
speech-based operating inter- 
faces. Lesseverything.com is a 
Ruby on Rails consulting firm, 
but Bristol is likely better 
known for his accounting pro- 
gram, Less Accounting. Devel- 
oping that application, he said, 
showed him just how much 
more complex the back end of 
software can become when the 
UI is simplified heavily. 

Bristol and others in the ses- 
sion compared user interfaces 
to vehicular dashboards, and 
much of the talk was focused on 
solidifying that metaphor. 
Nonetheless, Bristol called 
communication the linchpin of 
user interface development, 
saying, "If you don't have good 
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— Sukh Grewal, manager of 
* -"" SupportCentral at General Electric 



communication skills, you're 
not going to write a good UI." 

Sukh Grewal, manager of 
SupportCentral at General 
Electric, gave what was perhaps 
the most interesting talk of the 
conference. Back in 1999, Gre- 
wal was working as an engineer, 
primarily dealing with turbines 
and engines. The company then 
tapped him to head up the cre- 
ation of an internal Web-based 
knowledge base. The project 
began in earnest a few years lat- 
er, and eventually morphed into 
a social network. That network 
is now nine years old and sees 
almost 25 million hits a day 
from GE employees. 

USING THE WIKI MODEL 

Grewal said that the GE team 
learned a lot about the business 
applications of Web 2.0 tech- 
nologies. The fundamentals 
weren't always the same as 
those of popular websites, such 
as Wikipedia, he said. Ease of 
editing was certainly a priority, 



as were oversight and the abili- 
ty to delete useless or dead con- 
tent. But for enterprises, said 
Grewal, sometimes the most 
important aspect is simply 
being able to figure out who 
wrote what. There can be no 
anonymity, he said. 

More education came at the 
hands of company processes. 
"What we missed in 1999 is the 
fact that knowledge and people 
in an enterprise exist in the con- 
text of processes," said Grewal. 
"You can have all the knowledge 
you want, but there has to be 
some action, some service that 
delivers value to an organiza- 
tion. Communities are orga- 
nized on processes. Support- 
Central is eight years of 
development focused on com- 
munity needs to deliver 
processes. A process is how 
organizations generate value. 
This was an epiphany to us, and 
it changed our entire direction." 

Today, SupportCentral fea- 
tures a number of methods for 



grouping people together. Users 
are still given their own spaces, 
somewhat like MySpace, with 
their own photos and room for 
storing personal files. But the 
groups to which those users 
belong generate much of the 
site's usefulness. 

Users can join expert groups, 
which are accessed when prob- 
lems arise in the field. If a com- 
pany in Australia has an emer- 
gency with its generator, the 
closest support representative 
can quickly find the group of 
experts at GE who built the 
device and connect them to the 
customer with the problem. That 
lets engineers who've been 
moved to new projects continue 
to offer their expertise on designs 
in which they've had a hand. 

In that regard, said Grewal, 
large enterprises like GE can 
behave much more like smaller 
companies. 

Also key to the success of 
SupportCentral, said Grewal, is 
the constant pruning of dead 
content. "We have over 50,000 
communities. In minutes, any- 
body at GE can establish a 
community. We delete about 
one-third of every community 
created," said Grewal. "It's no 
big deal, just cleanup time." 

Indeed, the removal of 
dead content was a resounding 
theme among conference at- 
tendees in the social network- 
ing and wiki spaces. 



SupportCentral has also 
changed methods for dealing 
with internal files, said Grewal. 
"We started out with a simple 
document management system, 
but we ended up with almost 
full document management 
because some communities real- 
ly need it. Since we already have 
a platform here, for us to switch 
them over from uploading Word 
docs to just using Zoho [a Web 
based office suite] natively is 
very easy. We can save some 
money on Microsoft licenses." 

Perhaps the most interesting 
discovery that has come from 
SupportCentral is the wide 
variety of statistics that can be 
gleaned from usage. "We have 
documented evidence that peo- 
ple work 10% to 20% less on 
Friday," said Grewal, because 
that's the percentage by which 
SupportCentral hits are down 
every Friday. 

Of course, that small hit from 
weekend lust is a drop in the 
bucket compared with the time 
saved by the system overall. 

"People manage communi- 
ties that help them do their job. 
The reason they go here is 
because they find answers there. 
The experts are happy because 
they're not getting the same calls 
with the same questions again 
and again," said Grewal. "We 
have documented evidence of 
this system giving productivity 
gains of up to 70%." I 



Serena enables mashups on demand 



BY JEFF FEINMAN 

Nearly one year after creating 
its Business Mashup suite, Ser- 
ena Software has made the 
mashup building box available 
on demand, letting users build 
and deploy mashups without 
the need for an IP infrastruc- 
ture. The company has also cre- 
ated Rich Interface Mashups, 
which tie widgets, RSS feeds 
and Flash components into Ser- 
ena mashups. 

Also new is an on-demand 
application that facilitates agile 
project management across dis- 
tributed teams. Agile On 
Demand integrates with the 
Business Mashup suite. 

Application development 
increasingly is taking place out- 
side of traditional circles as 



more tech-sawy people enter 
the workforce, Serena said. 
Rich Interface Mashups let 
users coordinate activities such 
as business meetings and devel- 
opment projects without having 
to write code, according to the 
company. 

"Traditionally, our mashups 
have been focused on process, 
like coordinating activities and 
software development work- 
flows," said Nathan Rawlins, 
senior director of product mar- 
keting at Serena. "[Users] can 
schedule meetings through 
Google Calendar and do all 
sorts of things using Rich Inter- 
face Mashups." 

The Agile On Demand 
application, meanwhile, covers 
such agile activities as sprint 



planning and backlog manage- 
ment. It will enable velocity 
analysis and acceptance test 
reports, and will offer RSS noti- 
fications and instant messaging 
integration. 

As adoption of agile processes 
has broadened, requirements 
have changed, according to Sere- 
na. Agile On Demand provides 
"virtual coaching," letting users 
set up times to speak with consul- 
tants. Serena partnered with Val- 
tech, an IT consulting company 
that specializes in agile methodol- 
ogy, to provide the feature. 

"Agile practices have had 
higher adoption rates among 
smaller, collocated development 
teams, which today are a rarity," 
said John Scumniotales, co- 
developer of the Scrum agile 
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Serena's Agile On Demand application includes sprint planning and backlog 
management, as well as velocity analysis capabilities. 

methodology and Serena's vice multimethodology environ- 

president of product develop- ments, making agile accessible 

ment. "Agile On Demand has to any development team." 
been designed from the ground Agile On Demand is expected 

up to support multiproject and to ship by the end of the year. I 
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COMPANIES 



Adobe has made ColdFusion 8 available for free to students and teach- 
ers so it can be integrated into school curricula. Adobe said academic 
institutions increasingly are looking to have their students develop 
rich Internet application skills. 



NEW PRODUCTS 



Hosted on-demand communications provider IntelePeer has created a 
technology platform that adds voice, video and data to websites and 
enterprise software applications. AppworX can AnnVA/ory 
deliver voice and multimedia features from within 
any Web or IP-based application to any phone or network-connected 
device, according to the company . . . Rally Software has released a new 
product management program that lets product managers and busi- 
ness analysts collect user feedback. Rally Product Manager also lets 
users display development progress in Rally's agile life-cycle manage- 
ment product and in Salesforce.com's CRM system to give nondevelop- 
ment stakeholders information on feature requests, the company said . 
. . Sierra Wireless released an SDK that can work with Windows CE 
operating systems. The SDK offers original equipment manufacturer 
customers a more streamlined development cycle for devices that use 
Sierra Wireless 3G embedded modules, according to the company. 



UPDATES 



ALM company Aldon has added integration with Zend to increase the 
use of PHP in its namesake Aldon product suite. The company said 
PHP developers can gain visibility across Web-centric development 
projects by using its suite . . . Gimpel Software, an analysis and secu- 
rity company, has added static variable tracking and other improve- 
ments to version 9.0 of PC-lint for C/C++, a static analyzer for C and 
C++ programs. The new static variable tracking feature adds to the 
product's interstatement and interfunction value tracking, the compa- 
ny said. Other new features include multithread analysis, stack usage 
analysis, enhanced message control and message portrayal through 
HTML output. This is the product's first update since 2001 
. . . Green Hills Software has made available its u-velOSity microker- 
nel for the ARC 600 Core Family of configurable cores and the ARC 
Sound Subsystem. The company said u-velOSity is ideal for applica- 
tions with ARC cores, as it has a ROM footprint of 2KB and service call 
times as low as 30 cycles. ARC International provides consumer IP to 
semiconductor companies . . . HyperOffice, a collaboration software 
provider, has put out a Spanish version of its online business collabo- 
ration tools. HyperOffice executives said that its product suite is 
aimed at small and medium businesses growing in Central and South 
America . . . Skyway Software, a provider of rich Internet application 
products and Web services, added integration with Apple Mac OS X 
and Oracle WebLogic 10 to the new version of 
Skyway Builder, its RIA building and deploy- 
50 FT WARE ment product. Skyway Builder 6.0.2 also has 
improved functionality and expanded binary content controls . . . Mod- 
eling and flowcharting company SmartDraw has added network and 
smart website mapping to the new version of its business graphics 
software. SmartDraw 2009 lets users network according to LDAP 
(Lightweight Directory Access Protocol). Additionally, users can type a 
website domain to generate a site map. 
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PEOPLE 



Holger Friedrich has been placed on Software AG's management 
board and will be responsible for global professional services. Friedrich 
has held executive positions with McKinsey & Company and SAP, 
where he served as a senior vice president. He also co-founded SPM 
Technologies, an IT consulting services firm . . . Godfrey Sullivan has 
been named CEO of search company Splunk, also becoming president 
and joining the company's board of directors. Sullivan previously was 
CEO of performance management software company Hyperion Solu- 
tions, which was acquired by Oracle in early 2007. He is also on the 
board of directors for Informatica and Citrix Systems. I 



VMware loses another top 
exec as Rosenblum 



BY JEFF FEINMAN 

Virtualization market leader 
VMware has seen yet another 
key executive leave the compa- 
ny in the wake of CEO and co- 
founder Diane Greene's dis- 
missal. This time the departing 
exec is chief scientist Mendel 
Rosenblum — the company's co- 
founder and Greene's husband. 

The September announce- 
ment of Rosenblum's resigna- 
tion came two months after 
Greene was dismissed and a lit- 
tle more than a week after 
Richard Sarwal, executive vice 
president of research and devel- 
opment, quit to rejoin Oracle. 

"I was somewhat surprised 
that [Rosenblum] didn't leave 
sooner," said Charles King, 
principal analyst with Pund-IT 
"It had to have been difficult, 
with his wife leaving the com- 
pany a couple of months ago. 
It's always great for your 
founders to be with the compa- 
ny for as long as possible, but 
executive turnover in the IT 
industry is expected." 

Paul Maritz, a former 
Microsoft senior executive who 
founded Pi, replaced Greene as 
CEO in late July. Maritz had 
joined VMware parent EMC 
after that company acquired Pi 
in February. He was president 



of EMC's Cloud Computing 
division before taking the CEO 
slot at VMware. 

King said he doesn't expect 
any significant cultural changes 
to occur under Maritz. VMware 
is an engineering-proven com- 
pany, and Maritz should pre- 
serve that, he said. 

"Issues [Maritz] needs to 
attack over the next few months 
would be to give a solid sense of 
where the company is today and 
a blueprint for where VMware 
is headed in the future, and how 
he intends to take the company 
that way," King said. 

VMware is still the company 
to beat in virtualization, offering 
the most-sophisticated solutions 
available, King said. But he 
added that, "obviously, VM- 
ware's got some major competi- 
tors. Anytime you have compa- 
nies — including Microsoft, Ora- 
cle and Citrix — breathing down 
your neck, you've got to keep an 
eye out." 

Laura DiDio, a senior ana- 
lyst with the Yankee Group, said 
that with growing competition 
from Microsoft and its Hyper-V 
hypervisor, VMware needs lead- 
ers with more marketing knowl- 
edge (Greene and Rosenblum 
came from engineering back- 
grounds). "Great marketing 




Mendel Rosenblum follows Diane 
Greene and Richard Sarwal out. 

combined with so-so technology 
will get you further, faster, than 
great technology with so-so 
marketing," DiDio said. 

Rosenblum and Greene 
founded the company in 1998, 
and Rosenblum is credited for 
helping to create the x86 virtual- 
ization market. He will continue 
on as a professor at Stanford 
University, where he obtained 
his engineering degree. 

Rosenblum's "technical lega- 
cy and influence on VMware, 
both the company and the many 
engineers whom he mentored, 
will continue long into the 
future," said Mary Ann Gallo, a 
VMware spokeswoman. "He will 
be missed, and we all wish him 
the very best." I 



HOSTED VM PLATFORM GOES ON-PREMISES 



BY DAVID WORTHINGTON 

A virtual infrastructure provider 
is letting enterprises progres- 
sively adopt its cloud services 
alongside their existing on- 
premises software. 

Skytap offers an optional 
API that blends its Virtual Lab 
platform with customers' on- 
site resources. Virtual Lab pro- 
vides hosted virtual machines 
and supports hypervisors from 
Citrix and VMware, with sup- 
port for Microsoft's Hyper-V 
said to be in the works. 

"The API is an on-ramp to 
the cloud," said director of 
product management Ian Knox, 
noting that some customers, 
concerned about reliability, are 
reluctant to migrate production 
systems completely. The API 
provides VPN connectivity to 
expose virtual machines on-site 
as if they were in the same envi- 
ronment, said Knox. The ser- 
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Skytap's VPN makes virtual machines available as local resources. 



vices have a representational 
state transfer interface and stat- 
ic IP addresses. 

Virtual Lab comes populat- 
ed with a library of virtual 
machines, but customers can 
customize them to their hard- 



ware environment and can also 
upload their own, Knox said. 

The preconfigured virtual 
machines are tuned for ma- 
jor applications, databases and 
operating systems, according to 
Skytap. I 
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Microsoft talks BizTalk 2009 features 

Update will include improvements to Web services, added ALM functions 



BY DAVID WORTHINGTON 

Microsoft is preparing a major 
release of BizTalk Server that 
will leverage functionality added 
to the company's application 
platform stack since BizTalk 
Server 2003 R2 shipped. 

BizTalk Server 2009 will 
become generally available in 
the first half of next year, said 
Burley Kawasaki, director of 
product management in the 
Connected Systems Division at 
Microsoft. A Community Tech- 
nology Preview will be released 
before the end of this year. 

Application platform sup- 
port will be extended to .NET 
Framework 3.5 Service Pack 1, 
SQL Server 2008, Visual Studio 
2008 SP1 and Windows Server 
2008. BizTalk Server will take 
advantage of failover clustering 
features from Windows Server 
and will support Hyper-V, 
Microsoft's hypervisor. 

Integration with Visual Stu- 
dio Team Foundation Server 
will add ALM functions such as 
automated builds, bug tracking, 



source controls and multiparty 
development. The underlying 
BizTalk project system for Visu- 
al Studio will also be improved, 
according to the company. 

The new features will 
require Visual Studio 2008, 
said Kawasaki. "A lot of inte- 
gration we are doing builds on 
top of 2008 wave," he said. 

What's more, BizTalk will 
have out-of-the-box capabilities 
for business activity monitoring 
with SQL Server 2008 Analysis 
Services, as well as support for 
Unified Dimensional Model 
cubes and real-time aggrega- 
tions used in Microsoft's Perfor- 
mancePoint Server 2007 busi- 
ness intelligence product. 

Ken Vollmer, a principal ana- 
lyst for Forrester Research, said 
he believes the planned improve- 
ments "signal Microsoft's continu- 
ing intent to make this product a 
leading solution in the integration 
space, while ensuring that its 
development is synchronized with 
other major initiatives inside of 
Microsoft. That's a good strategy." 




Burley Kawasaki says BizTalk 2009 
will need Visual Studio 2008. 

Outside of the Microsoft 
stack and beyond the firewall, 
the 2009 release is slated to 
have a UDDI 3.0 registry that 
will provide for extended dis- 
covery services, registry affilia- 
tion, a subscription API and 
support for digital certificates 
for authentication. 

B2B SUPPORT 

For business-to-business inte- 
grations, Microsoft is broaden- 



ing its support for AS2 and EDI 
data sharing protocols. New 
capabilities will include support 
for multiple message attach- 
ments, configurable auto mes- 
sage resend and file name 
preservation. 

BizTalk Server 2009 updates 
all business rules and message 
schemas for compliance with 
the SWIFTReady Financial 
EAI Gold certification, increas- 
ing functionality as a result. 

The company also vows to 
offer broader guidance for 
applying Enterprise Service 
Bus (ESB) usage patterns and 
other tasks. 

Inside the firewall, BizTalk 
will include implementations of 
more-recent versions of CICS, 
CICS HTPP Transport, DB2, 
DB2/400, DB2 Universal Data- 
base, IMS and WebSphere 
MQ, according to Kawasaki. 

In addition, the company is 
developing a Line of Business 
Adapter for Oracle E-Business 
Suites and SQL Server, as well as 
improving its existing set of 



adapters, said Kawasaki. Adapters 
are available for MySAP ERP, 
Oracle Database and Siebel 
CRM business applications. 

The company is also updat- 
ing BizTalk's RFID standards 
support to adhere to industry 
standards, including LLRP, 
TDS, TDT and WS-Discovery. 
Another standard, EPCIS, will 
not be fully implemented. 

In the release beyond 
BizTalk 2009, Microsoft 
intends to collaborate with its 
research division to develop 
productivity enhancements 
such as complex mapping, said 
Kawasaki. Other features will 
include complex trading part- 
ner management, low-latency 
messaging enhancements and 
additional ESB guidance. 

Another goal is to extend the 
reach of BizTalk's enterprise 
asset tracking to portable 
devices and laptops by leverag- 
ing its existing RFID platform. 

Customers will also be able 
to use the "Oslo" wave of mod- 
eling tools to create composite 
applications. Services exposed 
through Windows Communica- 
tion Foundation by previous 
versions of BizTalk may also be 
used with Oslo modeling tech- 
nologies, said Kawasaki. I 
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Amazon gets enterprising 



BY ALEX HANDY 

The cloud has formed on the 
horizon, and Amazon has drawn 
a map to get there. On the San 
Francisco stop of an evangelical 
tour supporting its Web Ser- 



vices offerings, the company 
hinted at a future that would 
include regulatory and security 
compliance, Windows support 
and the possibility of new ser- 
vice hosting facilities in Asia. 



The company is looking at 
enterprise needs now that its 
offerings have matured, Adam 
Selipsky, vice president of Ama- 
zon Web Services, told the 
crowd. "It's early days, but we 



like the way the business is 
shaping up," Selipsky said. 

Jeff Barr, senior Web services 
evangelist at Amazon, assured 
enterprises that the company is 
working to fall in line with the 



"In some projects we have five simultaneous 
database environments to keep in synch. 
I downloaded the SQL tools from Red Gate and the 
next 14 days were the best SQL days in my life." 

G. Haraldsson Kaupthing Bank 



"SQL Compare and SQL 
Data Compare synched 
30,000 product lines and 
the 12 associated tables 
in less than 20 minutes 
- a task that takes ^^ 
the best part of 
a day manually!!! 
Go try it and buy it 
NOW." 

Paul Cooke Boretec IT Ltd 




"SQL Compare and SQL Data 
Compare are the best purchases 
we've made in the .NET/SQL 
environment.. .We rely on these 
products for every deployment." 

Paul Tebbutt Technical Lead, Universal Music Group 




"I am literally staggered at 
how much more efficient 
it is to perform simple 
data transportation with 
SQL Data Compare. In 
some cases, it's up to 10 
times faster with SQL Data 
Compare than it would be 
with DTS." 

Nick Stansbury SAGE Partners Ltd 



i "Red Gate's SQL Data Generator has 

I overnight become the principal tool we use 

I for loading test data to run our performance 

I and load tests." 

I Grant Fritchey Principal DBA, FM Global 

1 

"SQL Prompt is a must-have 
tool for all T-SQL developers. 

Brian Brewder Brian Online 




"There are times that I love this 
business - this would be one 
of them. Because without SQL 
Compare, and given 700 rows 
in sysobjects plus 13,000 rows 
in syscolumns in the production 
db, it would've taken me hours 
to find.. .Now, what to do with 
the rest of my day :-)" 

Mark McGinty Database Analyst/Consultant 



"I used SQL Compare with a previous employer 
and loved it so much I brought the experience 
here. This time, we bought the whole package. 
Love it!" 

Jim Franklin Lead Solutions Developer, J2 Aircraft Dynamics 




The Sound of Productive 
Developers and DBAs 

The Red Gate SQL Toolbelt makes developers and DBAs talk. 
Our tools make you very fast and very accurate and this is clearly 
news that's worth passing on. Download a free trial of the most 
talked about tools for SQL Server. You'll save your company so 
much time you might find you want to share the news. 



www.red-gate.com/toolbelt 
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myriad compliance regulations 
and certifications needed to host 
serious business applications. 
He cited Sarbanes-Oxley and 
HIPAA compliance as targets, 
but he left the door open to 
security certifications as well. 

No timeline was given for 
those projects, however. "Its an 
unprecedented level of openness 
for us," noted Barr. 

Enterprises also want Win- 
dows server support in the 
cloud. Amazon has added 
Solaris and Red Hat Enterprise 
Linux to the list of operating 
systems that can be virtualized 
in its Elastic Compute Cloud 
(EC2) but has yet to offer Win- 
dows in that capacity. Barr said 
such support would be coming 
but declined to offer a timeline, 
citing EC2's beta status. When 
the service becomes generally 
available, a service-level agree- 
ment will be offered, he said. 

SLAs around Amazon's Sim- 
ple Storage Service forced it to 
refund around 25% of its user 
fees for August because of an 
outage, said one attendee, who 
wished to remain anonymous. 
While technical problems have 
not been common, Amazon has 
experienced outages of its 
entire cloud. 

EASTWARD EXPANSION 

Another point of pain is the rel- 
atively slow access to Amazon 
services in Asia. The company 
currently runs data centers in 
Europe and North America, 
but Barr and others hinted that 
Asia would be a site for future 
material expansions. 

Barr also discussed the com- 
pany's DevPay service. "We 
need to make sure our develop- 
ers can build a business around 
Web Services. DevPay allows 
you to take basic services, graft 
your own presentation and 
billing model around those, and 
sell those to your customers," 
he said. Thus, SaaS applications 
hosted in the cloud can be sold 
on an hourly basis. 

Barr summed up the allure 
of Amazon Web Services with 
an analogy to a Belgian brewery 
that once generated its own 
electricity in the basement. 

"Think back 100 years ago," 
he said. "There was no power 
grid. If you wanted power, you 
needed to generate it yourself. 
You needed to distribute it 
within your organization. You 
had to have all of that low-level 
infrastructure to run your beer 
business. 

"The beer didn't taste any 
different." I 
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Active Endpoints orchestrates process models 



BY DAVID WORTHINGTON 

The developer of a visual service 
orchestration environment for 
Java has updated its product to 
export business process models to 
Business Process Execution Lan- 
guage (BPEL) for fine-tuning 
workflows that involve people. 

Active Endpoints said the 
addition of complex event pro- 
cessing in version 6.0 of 
Active VOS lets people be more 
responsive to processes. 

The revised environment 
uses BPEL4PEOPLE and WS- 
Human Task to recognize and 
work with human-focused 
tasks. It works in conjunction 
with debugging, deployment 
and testing facilities to help 
project teams design and main- 
tain composite applications. 

Active VOS 6.0 adds Business 
Process Modeling Notation; its 
designer has a view for BPMN 
similar to its existing BPEL can- 
vas, said product manager Mike 
Moniz. Developers can add 
metadata to the model and simu- 
late it with real or historical data 
before exporting it to BPEL or, 
alternatively, Extensible Business 
Document Language, he said. 

BPEL permits the logical 
model to be transformed into a 
running application; likewise, 
BPEL processes can be convert- 
ed into BPMN for documenta- 
tion. Active VOS can import 
BPMN models from other tools, 
including Microsoft Visio. 

New complex event process- 
ing (CEP) capabilities can help 
identify when real-world opera- 
tions run afoul of modeled 
processes. ActiveVOS' CEP 
engine can be used to identify 
key performance indicators 
and patterns within a process 
using the Event Processing 
Language, and developers can 
adjust processes in response, 
explained Moniz. 

"ActiveVOS 6.0 helps elevate 
SOA investments and developer 
knowledge to the level of busi- 
ness process outcomes," Dana 
Gardner, principal analyst at 
SOA think tank Interarbor Solu- 
tions, said in a prepared state- 
ment. "By focusing on practical, 
visual tools for creating services- 
based applications — and inte- 
grating many process orchestra- 
tion features into a single 
product — ActiveVOS 6.0 accel- 
erates the productivity returns 
of process-centric applications. 
The market clearly needs to 
better empower enterprises and 
developers to reap business- 



level rewards from their IT sys- 
tems and assets, especially as 
they examine and invest in ser- 
vices-oriented architecture." 

In response to customer 
feedback, Active Endpoints has 
updated its console look and 



feel, adding content such 
business intelligence and re- 
porting tool dashboards to help 
business analysts and end users 
monitor business process activi- 
ty, Gardner said. 

It also added a wizard that 



lets developers reuse plain old 
Java objects as native Web ser- 
vices to orchestrate existing Web 
services, Moniz said. 

ActiveVOS 6.0 runs on Java 
EE servers such as JBoss, Tom- 
cat, Web Logic and WebSphere. 



It is priced at US$12,000 per 
CPU socket for deployment 
licenses and $5,000 for devel- 
opment licenses. Active End- 
points asks customers to con- 
tact the company on pricing for 
virtualized environments. I 
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Analyst asks: What's Oracle's SOA story? 



BY DAVID WORTHINGTON 

Oracle has agreed to purchase 
ClearApp, a provider of manage- 
ment solutions for SOA-based 
applications, for undisclosed 
terms in a deal that is expected to 



close by year s end. Oracle said it 
plans to combine ClearApp prod- 
ucts with Oracle Enterprise Man- 
ager, stating the move would cut 
downtime and improve service. 
But one analyst questioned 



how many management vendors 
Oracle must acquire before it has 
a coherent SOA strategy. 

ClearApp s flagship product, 
QuickVision, automates appli- 
cation performance manage- 



ment and correlates the ser- 
vices provided by applications 
to the code components sup- 
porting those services. "Deep 
visibility into the components 
underlying SOA-based compos- 
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ite applications is a critical part 
of the SOA management story, 
and that's what ClearApp brings 
to Oracle," ZapThink managing 
partner Jason Bloomberg wrote 
in an e-mail. 

Bloomberg added, however, 
that the acquisition raises more 
questions than it answers, noting 
that Oracle had already acquired 
a group of companies that devel- 
op similar products, such as 
Auptyma, BE A Systems, Con- 
fluent Software and Moniforce. 

Oracle is pursuing a "Frank- 
enstein" strategy by putting a lot 
of parts together and "hoping for 
lightning," Bloomberg wrote. 
"Will Oracle be able to take this 
cobbled-together story and 
compete with the established 
incumbents ... as well as focused 
players like Tidal Intersperse?" 

Oracle has experience in 
assimilating acquired technolo- 
gies and taking care of the cus- 
tomers who accompany them, 
Bloomberg acknowledged, "but 
every such acquisition sets the 
bar of success higher." I 

ZEND SPRUCES 
UP WITH AJAX, 
SOAP LINKS 

BY JEFF FEINMAN 

Zend has added integration 
with the Dojo JavaScript toolkit 
in the new version of its PHP 
programming platform. 

Zend Framework 1.6 makes it 
easy to integrate AJAX and 
JavaScript with PHP applica- 
tions, according to the company. 
It includes a Dojo view helper for 
setting up the Dojo environment, 
along with form elements and 
decorators for integrating with 
Dojo s Dijit library. A new JSON- 
RPC server implementation and 
class can manipulate Dojo data 
envelopes in Zend. 

Zend Framework now oper- 
ates with the SOAP Web services 
protocol. Features around SOAP 
include auto-discovery as well as 
client and server classes that can 
operate in both Web Services 
Description Language and non- 
WSDL modes. Unit testing fea- 
tures for controllers enable agile 
practices such as unit testing and 
test-driven development. 

Other improvements to the 
framework, shown at ZendCon 
2008, include a component for 
displaying large data sets from 
multiple sources, a service pro- 
viding text-based CAPTCHA 
images, and smaller XML docu- 
ments that are easier to read. I 
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Google's packing Chrome in browser war 



BY DAVID worthington Chrome became available 

An 800-pound gorilla has joined last month as a download for 

the browser market. Google Windows users in 100 countries, 

has released a beta version of It features a thread manager for 

Chrome, an open-source brows- plug-ins and tabs as well as a new 

er designed to make Web appli- JavaScript engine that runs inde- 

cations faster and more reliable, pendently of the browser. 



"Chrome is optimized to be 
an application browser, not a 
general-use browser. Its target 
is less IE [Internet Explorer] 
and more Windows. So the 
application developers getting 
targeted initially are the same 



set currently building applica- 
tions for the Android phone 
(and probably the iPhone)," 
Rob Enderle, president and 
principal analyst of the Enderle 
Group, wrote in an e-mail. 
Chromes release is a flank- 




ing move against Windows and 
a springboard for Google Apps 
targeting Microsoft Office, 
Enderle wrote. But he added 
that its success would depend 
largely on how well Web appli- 
cations replicate the responsive- 
ness of in-premises applications. 

Chrome runs plug-ins and 
tabs as isolated processes. In an 
online comic explaining its 
design decisions, Google wrote 
that each tab is its own process, 
with its own copy of global struc- 
tures. Thus, rendering errors or 
JavaScript operations can no 
longer lock up or crash the 
browser. Another benefit is less 
memory fragmentation, since 
each process recycles its own 
memory and performs garbage 
collection. Spawning off tabs as 
individual processes consumes 
more memory upfront, however. 

Google engineers in Den- 
mark developed Chromes 
JavaScript engine. Called V8, it 
parses and compiles JavaScript 
into representative binary code, 
eliminating the need for 
JavaScript to be reinterpreted by 
the browser and thus improving 
speed, Google said. Chrome 
includes an API for V8, which 
can be used by other applica- 
tions in addition to Chrome. 

"Competition often results in 
innovation of one sort or anoth- 
er — in the browser you can see 
that this is true in spades this 
year, with huge JavaScript per- 
formance increases, security 
process advances and user inter- 
face breakthroughs," Mozilla 
CEO John Lilly wrote in his 
company blog. "I'd expect that 
to continue now that Google has 
thrown their hat in the ring." 

While it may be innovating, 
Google owes the open-source 
community a tip of its hat. 
Chrome is an amalgam of open- 
source software, borrowing from 
Apple and Mozilla, and is itself 
licensed under the BSD license. 

Google chose Apple WebKit 
as its rendering engine, be- 
cause, according to the compa- 
ny, WebKit is well suited for 
mobile devices, performs well 
and has a low memory footprint. 
Many other components come 
directly from Mozilla Firefox. 

But reliance on the work of 
others comes at a price. Shortly 
after its release, security experts 
uncovered several vulnerabilities 
in Chrome, including a critical 
flaw stemming from Google's 
use of WebKit and a flaw in one 
of the browser's core DLLs. I 
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More models invited to Artisan Studio 



BY JEFF FEINMAN 

Embedded modeling tool 
provider Artisan Software Tools 
has added integrations with 
similar products and expanded 
the model-driven development 
techniques available in its flag- 
ship modeling product. 

Artisan Studio operates with 
Object Management Group's 
SysML, UML and various 
architectural frameworks. Ver- 
sion 7.0 adds a directional 
Doors Synchronizer that 
strengthens graphical SysML 
requirements traceability man- 
agement, using information 
from Telelogic s Doors require- 
ments definition and manage- 
ment tool, according to Artisan. 

A Simulink Synchronizer lets 
systems engineers define func- 
tion block diagrams in Math- 
Works' Simulink model-based 
design environments and export 
them into an Artisan Studio 
SysML model for further devel- 
opment. The Simulink Synchro- 
nizer lets engineers integrate 
parametric equations, require- 
ments and code with full control 
of information mapping between 
Simulink and Studio. 

A 3- Way Sandbox Merging 
feature provides an area for mul- 
tiple development teams to work 
on the same model without 
duplicating items. 

"Artisan Studio has deliv- 
ered a collaborative working 
environment to thousands of 
users across an extensive range 
of complex applications," said 
James B. Gambrell, president 
and CEO of Artisan Software 
Tools. "Its centralized data 
repository relieves companies 
of the significant management 
overhead generally associated 
with multiuser systems and 
software development, and its 
domain-specific profiling capa- 
bility enables it to be tailored to 
support project needs associat- 
ed with architectural frame- 
works such as DoDAF [the 
Department of Defense Archi- 
tecture Framework] and 
AUTOSAR [the Automotive 
Open System Architecture]." 

To reinforce the commit- 
ment to OMG's Model Driven 
Architecture, the company 
said, Artisan Studio 7.0 allows 
additional model-driven devel- 
opment techniques, along with 
C# automatic code generation. 
The C# code generation model 
contains default design patterns 
that specify the mapping from 
UML to C#. Engineers can 



alter the mapping as necessary 
to manage it as a project artifact. 
Improved integration with 
Wind River's VxWorks RTOS 
debugger enables new debug- 
ging capabilities on multiple 
remote targets, Artisan said. 



Executives said version 7.0 
can manage threading and 
queuing issues that arise within 
embedded real-time applica- 
tions. Engineers and developers 
can depict current values or 
attributes and a model's behav- 



ioral characteristics; these can 
be used to validate a model by 
injecting errors into it. 

Artisan Studio's component 
sharing wizard now allows the 
sharing of components among 
product variants in a controlled 



manner. That permits System 
and Software Product Line 
development in Artisan Studio, 
the company said. 

Additionally, Artisan Studio 
7.0 has new interface functions 
that let the user reorder tabs in 
browsers, hide and dock panes, 
and use the keyboard to navigate 
within views. I 
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What's your PDF? 

Precise Document ormatting 

With activePDF Server™, you gain full control over your PDF output with conversion 
options that allow you to specify page size, compression and resolution options, 
embed text, create bookmarks, concatenate to existing files, and more. Licensed 
per server, you can easily add PDF generation to virtually any Windows application. 



opulate ynamic orms 

With activePDF Toolkif's form-filling capabilities, you can dynamically populate 
PDF forms with data and images from a database, allow users using only Adobe 
Reader to fill-in and save forms and use PDF forms as document templates to 
precisely control image placement and resizing. With Toolkit's robust API, the 
automation of virtually any PDF manipulation task becomes possible - append, 
stamp, stitch, merge, paint, secure PDF and more. 



Promote Digital Fidelity 

Do you need to standardize PDF output within your enterprise? With DocConverteC 
you can easily use built-in support for "watched" folders to implement server-side 
PDF generation in a matter of minutes, with full control over the PDF output at the 
server level. Or, use DocConverter's programmable COM object to integrate 
convert-to-PDF functionality within your enterprise application. 



resent ata ashionably 

Ensuring precise layout of an HTML document can be a nightmare, especially when 
printing. PDF guarantees pixel-perfect layout every time as what you see is what 
you print. With activePDF WebGrabbeC you can dynamically convert any URL, 
HTML stream, or HTML file to PDF on the fly, while maintaining embedded styles. 



Download your free trial version today at www.activePDF.com 






A LongJump for Java 

Platform-as-a-service provider 
takes aim at Salesforce.com 



BY ALEX HANDY 

The idea behind a platform as a service 
is to take all the standard application 
tooling and hosting needs, box them 
into a ready-made, pluggable service 
and attach them to whatever application 
a developer can build. Salesforce.com 
has offered such a system through its 
Apex language. 

Now LongJump has announced that 
its SaaS platform supports direct Java pro- 
gramming, a capability that LongJump 
says leapfrogs Salesforce in appeal. 

It wasn't easy to enable developers 
to write Java directly into their sys- 
tems, said Pankaj Malviya, CEO and 
founder of LongJump. The toughest 
part was figuring out "how to make 
sure someone is not able to take all the 
system resources. Once you create an 
artifact, how do you make sure it's con- 
tinuously following the model and not 
allowing them to access someone else's 
data? We wrote our own class loader to 
handle this." 

Malviya said LongJump saves appli- 
cation developers time by handling the 



standard necessities right off the bat. "If 
you take a Java EE server and decide to 
write an application, you're going to 
spend an enormous amount of time 
doing things like developing authentica- 
tion methods against LDAP [Light- 
weight Directory Access Protocol] , or a 
dashboard creator. [Now] all those basic 
things needed today in the collaborative 
environment are available out of the 
box. As a developer, I can focus on the 
core problem." 

The LongJump development toolkit 
gives developers an Eclipse plug-in for 
writing directly into Longjump's system. 
Developers can also code inside their 
browser, since LongJump includes an 
IDE of sorts on its site. Developers 
using the Eclipse plug-in can code while 
away from the Internet, then upload 
code later. 

Standard pricing for LongJump 
application hosting is US$20 per user; 
the development tools are free. Stan- 
dard Java is supported, Malviya said, 
but extensions such as Spring or Struts 
are not. I 
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Internet Explorer 8 beta lets 
end users cover their tracks 



BY DAVID WORTHINGTON 

Microsoft released a beta refresh of 
Internet Explorer 8 that targets end 
users, offering new privacy and search 
features. 

Beta 2 introduces granular privacy 
settings that Microsoft has dubbed 
InPrivate browsing and InPrivate block- 
ing. InPrivate helps users cover their 
tracks as they browse by informing them 
about cookies that may observe their 
browsing history and letting users selec- 
tively remove them. 

Likewise, it eliminates all traces of a 
browsing session, leaving behind no user 
names, passwords or search queries. 

"[InPrivate browsing] is a double- 
edged sword," said Laura DiDio, a prin- 
cipal analyst with Information Technolo- 
gy Intelligence Corp. "It is good for 
home users, but presumably it will have 
the same features for corporate users — 
which might not be something that is 
welcomed by supervisors." 

With InPrivate blocking, users may 
subscribe to lists of websites to block or 
allow. Other changes targeting the user 
experience are crash recovery, a "diag- 
nose connection problem" button, the 



ability to reopen closed tabs, and Com- 
patibility View, which permits users to 
view websites that are "broken" by IE8's 
standards compliance. 

IE8 has three rendering modes: the 
default "full standards" mode, which 
has already passed the Web Standards 
Project's Acid2 test and supports CSS 
2.1; a mode that supports W3C stan- 
dards in the same way as IE 7; and a 
"quirks mode" that maintains compati- 
bility with earlier editions of the 
browser. 

It also selectively implements parts of 
the HTML 5 draft specification, includ- 
ing cross-document messaging, a client- 
side storage API, network connection 
awareness and a window location hash 
meant to place Web applications into the 
browser's back/forward stack. 

New search features fit within a 
concept that Microsoft calls "Reach 
Beyond the Page." Other parts of that 
concept include "Activities," essentially 
a dialog box that lists available Web 
services when a user selects text, and 
"WebSlices," which lets end users sub- 
scribe to portions of a Web page, 
including Silverlight controls. I 
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InterBase takes hard turn to SMP 

Update of venerable database axes versions that don't pass muster for multicore 



BY ALEX HANDY 

A relational database manage- 
ment system that began life 
more than 20 years ago as the 
brainchild of Digital Equip- 



ment engineer Jim Starkey has 
been refashioned with a sym- 
metric multiprocessing focus 
and additional security features. 
CodeGear, now part of 



Embarcadero, released Inter- 
Base 2009 in September and 
expects to field an embedded 
version with a smaller memory 
footprint this month. 



Michael Swindell, vice presi- 
dent of products at Embar- 
cadero, came along with Inter- 
Base when the database-centric 
company purchased Borland off- 
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shoot CodeGear in May. The 
shift to a database focus is a nat- 
ural for CodeGear, Swindell said, 
because "the vast majority of our 
customers are already using 
databases in some capacity. They 
either are using them in an 
embedded case, like an ISV, or 
they're line-of-business develop- 
ers building internal applica- 
tions. It's a great bridge between 
the two product sets." 

Embarcadero's CodeGear 
just finished a massive update to 
its C + + Builder and Delphi 
IDEs. Though those products 
were said to be ready in late 
August, the team delayed release 
to squash some more bugs. 

Thus, the InterBase update is 
relatively subdued. 

Perhaps the biggest change 
was the removal of versions that 
were not symmetric multipro- 
cessing (SMP) compatible. All 
versions of InterBase will now be 
able to use multiple processors 
and cores. That shift had started 
shortly after the release of Inter- 
Base 2008, but the new version is 
the first one available from 
launch with such support across 
the board. 

EXPANDED ENCRYPTION 

InterBase 2009 also adds secu- 
rity mechanisms, such as over- 
the-wire encryption and AES. 

But the changes won't trick- 
le down to the open-source 
Firebird database, which is 
based on InterBase, because 
that free database does not 
include SMP, disaster recovery 
or high-availability features. 

A single InterBase 2009 
license costs US$200, and an 
unlimited seat license goes for 
around $4,000, said Swindell. 

He noted that InterBase 
can function as a server or as 
an embedded database. This 
month, he said, InterBase 
ToGo will be made available. 
Normally, InterBase has a 
memory footprint of around 
100MB. ToGo will slash that 
spec to around 3MB, allowing 
the database to be used in 
more-restrictive application 
environments. 

"The InterBase engine is 
focused on more high-end engi- 
neering features," Swindell 
said. "It's used in a lot of mili- 
tary applications, a lot of tele- 
communications applications. 
It's good in installations where 
it need to be hands off." I 
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Black Duck floats nimbler Code Center 



BY ALEX HANDY 

All that open-source code can 
save developers time, but it 
tends to keep the lawyers up at 
night. Black Duck Software has 
made a name for itself in open- 
source code management; with 
the recent release of version 1.4 
of Code Center, it's promising 
more control and better search 
functionality. 

Topping the list of new fea- 
tures is the ability to designate 
entire stacks of software as 
approved from a legal, business 
and coding standpoint. Code 
Center tracks all the open- 
source components used in an 
enterprise; version 1.4 is the 
first that allows sets of code to 
be grouped together into 
approved stacks. Development 
teams thus can standardize on 
their own flavor of the LAMP 
stack, or build on top of a pre- 
approved set of Java compo- 
nents, without having to bring 
legal in on the decision. 

"Whether you call it 'soft- 
ware component assembly,' a 
'software supply chain' or 'soft- 
ware reuse,' the model for soft- 
ware development is about 
using many sources for your 
code," said Bill McQuaide, exec- 
utive vice president of products 
and services at Black Duck. 
"Code Center today adds 
enhancements to organize the 

GUI DESIGNER GETS 
UPDATE FOR GWT 1.5 

BY DAVID WORTHINGTON 

Instantiations has updated its 
Eclipse-based GUI creation 
tool for Google Web Toolkit 
(GWT) 1.5. 

GWT Designer 1.5 lets Java 
programmers create AJAX user 
interfaces for GWT applications. 
It is backward compatible with 
GWT 1.4.62 but supports GWT 
1.5 s added features, including 
Java 1.5 and bidirectional code 
generation for internationaliza- 
tion. It can also integrate with 
MyGWT and Widget Libraries. 

The product is based on 
Instantiations' WindowBuilder 
Pro technology, which lets devel- 
opers create and test rich Inter- 
net applications without AJAX 
coding. GWT Designer provides 
controls, composites, layouts, 
wizards and WYSIWYG builders 
for Eclipse, GWT and Java. 

A perpetual license costs 
US$124. Annual subscriptions 
are available as well. I 



complex relationships among 
open-source software compo- 
nents, helping developers 
ensure that a stack or subsystem 
abides by a company's open- 
source and other policies." 
Also new to Code Center is a 



more robust retinue of search- 
able databases of code. In addi- 
tion to Black Duck's reposito- 
ries, Code Center can now 
search through Koders.com to 
find open-source snippets. 
To accommodate those not 



on the development team, Code 
Center 1.4 adds the ability to 
make approval processes more 
complex than in previous ver- 
sions, so that executives, lawyers 
and coders can be strung into a 
standardized chain of command 



for code approval. Each user 
can log in and review the neces- 
sary documentation, then sign 
off and pass the process on to 
the next person in line. 

The new process control 
function includes the ability to 
upload documents to Code 
Center to allow for a more com- 
plete audit trail. I 
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YMware details road map for creating virtual data centers 



BY ALEX HANDY 

With its announced plans for a 
Virtual Data Center Operating 
System (VDC-OS), VMware is 
giving a name — and a promised 
form — to a concept that's been 
around for some time. 



At its conference in Las 
Vegas last month, the company 
detailed a road map for new 
capabilities, services, tools and 
monitoring systems, all working 
toward the goal of running a 
roomful of computers as a sin- 



gle entity Those clouds of com- and mobile devices as virtual- 
puters would mesh with exter- ized instances spun out and con- 



nal clouds for complete enter- 
prise cohesion, according to the 
road map. 

The VDC-OS will run appli- 
cations, user desktops, servers 



trolled by the single underlying 
data center operating system. To 
that end, VMware described the 
plan for its vStudio developer 
suite. The suite can now build 




vApp packages, Open Virtual 
Machine Format (OVMF) 
stacks of software and applica- 
tions, and the additional controls 
and policies surrounding them. 

OVMF was submitted to the 
Distributed Management Task 
Force standards organization in 
August. It includes descriptions 
of the hardware being virtual- 
ized as well as the software. 
VMware has extended the for- 
mat to include policy informa- 
tion and creation tooling in a 
beta of its vStudio software. 

"Today, when you deploy an 
application, you're deploying 
multiple virtual machines to- 
gether," said Raghu Raghuram, 
vice president of products and 
solutions at VMware. The vApp 
package model, Raghuram said, 
"describes a multi-tier applica- 
tion, and along with that, you 
attach policies that say, This 
application should be backed up 
once every two days,' or, This 
application can only talk on port 
753.' You can do this in vStudio, 
or you can manually create it as 
well." Both tools will be avail- 
able in VMware's cloud-comput- 
ing future. 

One meta-step down the 
stack sits the idea behind 
VMware's vCloud initiative. This 
newly announced push seeks 
continuity among clouds. The 
VDC-OS will allow machines to 
be ferried among clouds of 
VMware systems hosted in dif- 
ferent locations and on different 
cloud instances. The systems 
would also virtualize file systems, 
messaging queues and existing 
hypervisors. The company is 
aiming for a future where clouds 
both inside and outside of enter- 
prises can cooperate and inter- 
change work. 

VMware also said that there 
would be APIs and frameworks 
for developing directly to the 
VDC-OS. All of this should roll 
out in 2009, according to 
Raghuram. 

"People believe in virtualiza- 
tion," said Raghuram. "This is 
just further evidence of the legs 
left in virtualization and how 
we're extending it to solve a 
whole area of problems." 

The company will carry out 
its plans for the virtual data cen- 
ter without the input of its co- 
founders. Mendel Rosenblum, 
VMware's co-founder and chief 
scientist, resigned last month in 
the wake of the dismissal of his 
wife, CEO and co-founder 
Diane Greene (see page 6). I 



Turning data into INTELLIGENCE 

Associating your organizational data with location is the foundation for making critical 
strategic and operational decisions that improve performance, competitiveness, 
efficiency, responsiveness and effectiveness. 

PITNEY BOWES MAPINFO enables organizations to leverage Java, .NET or Web Services to build custom location intelligence 
solutions or add location to existing systems. Through this customization, organizations can: 

• Improve asset management by optimizing asset location 

• View key performance indicators such as revenue by sales territory 

• Improve fleet productivity and customer service by determining the best path for multi-point deliveries or routes 

Industry examples of location intelligence in action: 

• Telecommunications: strategically locate cell towers for maximum coverage and market penetration or identify 
new revenue through build-out opportunities 

• Insurance: lower aggregated risk to natural disasters by visualizing existing customers along with flood, 
hurricane and other relevant data 

• Government: create e-government, citizen self-service web portals 

• Retail: understand your true trade area for site selection and target marketing opportunities 

• Banking: optimize branch and ATM networks, improve sales performance and target marketing efforts 
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view streaming media pieces, download free SDK's and register for upcoming webinars. 
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PHP meets SOA 

WS02 library eyes databases as a service 



BY DAVID WORTHINGTON 

The developer of a library that can be used 
to create and consume standards-compli- 
ant Web services in PHP is looking to 
prove that service-oriented architecture is 
not just for Java and .NET programmers. 

Version 2.0 of WS02 s Web Services 
Framework for PHP (WSF/PHP) 
became generally available in Septem- 
ber. The library is written in C and is 
based on Axis2/C (WS02 is a major con- 
tributor to Apache). 

Data is a primary emphasis of the 
release: WS02 supports PHP data ser- 
vices in order to expose databases as a 
service in PHP platforms. WSF/PHP 
2.0 has an array-based API as well as 



nested query support, and it also 
accommodates multiple database 
engines through the PHP ActiveX Data 
Objects extension. 

The library also generates Web Ser- 
vice Definition Language files. 

"A DBA or Java guy would be happy 
to [create data services] in XML, but 
PHP people would rather write a script," 
said CTO Paul Fremantle. He added 
that WSF/PHP 2.0 includes a conver- 
sion tool (dbs2php) to take Java data ser- 
vice configuration files from the WS02 
stack and generate PHP files with them. 

"Exposing databases as a service 
makes it easier to bootstrap PHP for 
SOA," Fremantle said, noting that 
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WS02 says that WSF/PHP is more secure and reliable than other PHP SOAP libraries. 



many PHP applications are database 
applications. "SOA is not just for Java 
and .NET guys." 

WSF/PHP 2.0 is available as a free 
download, but technical support charges 
are applicable. 

SECURITY DETAIL 

The 2.0 release broadens the library's 
implementation of the WS-* Web stan- 
dards, adding WS-SecureConversation 
to enhance message security and WS- 
Trust to enable single sign-on. WS02s 



implementations of WS-Policy and WS- 
SecurityPolicy, which are used to config- 
ure security in Web services, were 
updated to accommodate the aforemen- 
tioned standards, according to Freman- 
tle. Additionally, Public-Key Cryptogra- 
phy Standards are now supported for 
key management. 

The release also makes it possible to 
map a representational state transfer 
API into PHP, and it supplements stan- 
dards support for caching large binary 
attachments. I 



LDRA improves editor configuration in test suite 



BY JEFF FEINMAN 

Automated software verification and test- 
ing company LDRA has improved editor 
configuration in its main product suite. 

LDRA 7.7 comes with an updated 
version of the TBreq requirements 
traceability tool and with TBvision, 
designed to help with defect and fault 
detection and with industry standards 
compliance. LDRA executives said that 
with the enhanced requirements trace- 



ability and graphical reports, developers 
can identify faults earlier in the develop- 
ment process. 

Editor configuration is improved in 
the new version of LDRA because the 
user can select a default source code 
editor or enter the details for another 
one, the company said. Enhancements 
to TBreq 2.2 include the ability to 
import requirement hierarchies like Use 
Cases and SysML. TBreq also has 



improved Microsoft Vista interoperabili- 
ty and DO-178B Level A certification. 

LDRA has made improvements to its 
TBrun automated unit testing tool by 
adding user control of linked libraries so 
that developers can customize the call- 
ing driver of test points, according to 
the company. There is also an updated 
data dictionary that creates values for 
application data types. The TBeXtreme 
automated test case creation tool now 



can work with user-defined data types. 

"With systems and software becom- 
ing increasingly complex, organizations 
need tools that support them in all 
stages of the software development 
cycle," said Ian Hennell, LDRAs oper- 
ations director. "By providing cus- 
tomers with a comprehensive set of 
tools for requirements traceability 
through to unit testing, LDRAs tool 
suite portfolio takes developers much 
closer to the goal of zero-defect soft- 
ware development." I 
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Developing Service-Oriented AJAX 
Applications on the Microsoft® Platform 

Daniel Larson 

Delve into the fundamental architectural principles and 
techniques for developing service-oriented AJAX ap- 
plications. This guide offers a code-heavy, example-based 
approach to learning how to write a modern services API 
and an AJAX front end that can easily be extended, reused, 
and integrated by third parties. Focusing on Microsoft 
technologies and enterprise servers, including Microsoft 
SharePoint® Server 2007, ASP.NET AJAX, and Microsoft 
.NET Frameworks 2.0, 3.0, and 3.5, this book walks you 
through a client-centric Ul architecture programmed 
against an XML service-oriented backend. 

Introducing Microsoft ASP. NET and AJAX: 
Architecting Web Applications 

Dino Esposito 

In this book, Esposito challenges readers to think beyond 
the "easy way to AJAX," which involves adding AJAX 
capabilities to a non-AJAX system designed in the old 
model of Web development. Instead, he proposes an 
alternate, if more difficult, paradigm involving new patterns 
and new complexities — and culminating in a new, pure- 
AJAX architecture. You'll learn why far better solutions 
result from the second, more radical approach — and you'll 
get practical guidance on how to implement this new 
architecture for Rich Internet Applications (RIAs). 
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Introducing Microsoft Silverlight 
2.0 

This guide describes how you 
can simplify the development 
and deployment of rich internet 
applications (RIAs) by using Silverlight 
2 tools with Microsoft Visual 
Studio® 2008 and the Microsoft 
.NET Framework. With Silverlight, 
RIAs install quickly via a small, on- 
demand plug-in. You'll discover how 
to begin building different types of 
Silverlight-based solutions, generate 
Silverlight applications dynamically 
on the server, create an XAML service, 
and more. The book also features 
a companion Web site with code 
samples in Microsoft Visual C#® and 
Visual Basic®. 

Programming Microsoft LINQ 

Data-rich applications can be 
difficult to create because of the 
tremendous differences between 
query languages used to access data 
and the programming languages 
commonly used to write applications. 
This practical guide covers the 
intricacies of LINQ (Language 
Integrated Query), a set of extensions 
to the Visual C# and Visual Basic 
programming languages. Instead 
of traversing different language 
syntaxes required for accessing data 
from relational and hierarchical data 
sources, developers will learn how 
to write queries natively in Visual 
C# or Visual Basic — helping reduce 
complexity and boost productivity. 
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Six Great Reasons to Attend SPTechCon 



The technical classes and 
workshops at SPTechCon are 
focused on practical tech- 
niques and practices you can 
put to work today! 

g Bring a group of developers, IT 
"pros and business teams to 
improve your whole organiza- 
tion's skills - and get a dis- 
count to boot! Contact us for 
group registration discounts! 



Take only the classes that 
work best for you. With 
more than 50 classes and 
workshops to choose from, 
you can make SPTechCon 
your own! 



O. 



See how the SharePoint 
ecosystem is growing and 
evolving by speaking with 
technical experts in our 
exhibit hall! 



Learn from the brightest 
minds in the SharePoint 
universe! All of our speakers 
either are Microsoft engineers 
or have achieved MVP status 
based on their in-depth 
knowledge of SharePoint. 

There's a shortage of 
' SharePoint experts! Develop 
your skills, and improve your 
own professional standing! 



For more information, 




What's at SPTechCon for IT professionals? 

SharePoint is way more than a collaborative corporate portal. But now 
everyone wants to leverage it for document management, business process 
management and corporate compliance. At SPTechCon, you'll learn best 
practices for managing a SharePoint environment and integrating it with other 
systems to unleash the full power of the software— and your company! 

What's at SPTechCon for 
business managers and analysts? 

SharePoint can bring great efficiencies to businesses, through the creation of 
line-of-business applications such as those used in human resources and order 
entry departments. SPTechCon features a heavy slate of classes to teach how to 
take full advantage of SharePoint, from business intelligence tools to reporting 
and much more. 

What's at SPTechCon for developers? 

SPTechCon offers a deep dive into the architecture, and provides practical 
classes on such SharePoint-centric features as Web parts, lists and pages. 
You'll learn how to create applications for SharePoint that solve real business 
problems, and also see what kind of third-party applications have already 
been created to run on top of SharePoint. 
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Tom Rizzo, 
w k Director of Microsoft 

f -^ jsn SharePoint, said: 

"The phenomenal uptake 
of Microsoft Office 
SharePoint Server is 
transforming organizations 
of all sizes, all industries and all geographies. 
Business leaders are envisioning new uses 
of SharePoint, and IT professionals and 
developers are gearing up to implement new 
applications as well as integrate SharePoint 
to other enterprise software. This is creating 
significant demand for training and education. 
We're delighted BZ Media is introducing this 
new SharePoint technical conference." 
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Rules for donating open-source code 



< continued from page 1 

rather than from traditional 
corporate sites. 

"There's still a perception that 
you participate but you don't 
expose your company's identity," 



Skerrett said. "That's a bit frus- 
trating because it would be nice 
to better understand who's con- 
tributing. My understanding is 
that [contributors] don't want to 
have any potentially negative 



perception come back to the 
company if things don't go well." 
And things can easily not go 
well, said Bernard Golden, 
CEO of Navica and author of 
the book "Succeeding with 



Open Source." 

The project to which a con- 
tribution is offered must be 
comfortable with the contribu- 
tors, Golden said. "Make sure 
you have a good relationship 
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with the maintainers of the proj- 
ect so that they know you and 
are willing to accept your code. 
It's not like you can just throw 
code in and say, T want this in 
the mainline, so snap to it.' " 

DO IT YOURSELF 

For companies looking at start- 
ing their own projects, Golden 
said, the road can be difficult. 
It's easier in that "you don't have 
to get permission from some- 
body, and it doesn't have to be 
accepted by anyone," he said. 
"The challenges come in the 
decision of what license you 
want it released under. Do you 
believe you can grow a commu- 
nity around what you've done? 
Because absent that, it's just a 
pile of code." 

Naturally, building a project 
just for the heck of it won't cre- 
ate a community from nothing. 

"I've worked in organizations 
where we debated heavily 
around having a certain piece of 
technology and whether we 
should create an open-source 
project out of it," said Black 
Duck's Vescuso. Teams should 
ask these questions, he said: "Do 
you consider this [technology] 
an expertise and core competen- 
cy of your team? Are you elimi- 
nating a competitive advantage 
if you do this [create an open- 
source project around your tech- 
nology]? You've got to be in a 
position to make the commit- 
ment to maintaining [the proj- 
ect] and being able to develop 
the community into something 
that is active and vibrant. " 

On the flip side, Vescuso 
said, "With any open-source 
project, contributors are going 
to consider a number of things. 
Who's behind it — how interest- 
ing are the people behind it? Is 
it making progress? If an open- 
source project doesn't see steady 
progress, it will die on the vine." 

"A really good example" of an 
open-source project that suc- 
ceeded because it met the crite- 
ria, Golden said, "is the AMQP 
project, a message queuing proj- 
ect incubated by J.P. Morgan for 
solving a problem they had, 
which was that available message 
queue products were expensive 
and inflexible. They said, 'We're 
not the only ones having this 
problem. This is something that 
helps us do what we do; it's not 
what we do. There's no IP pro- 
tection. Why don't we invite oth- 
er people in that could make it 
better and reduce our burden?' 

"It was so successful that 
they've now turned it over to 
the Apache Foundation." I 
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The Experience of Chart FX. The Innovation of Grid FX. 

Chart FX has long been considered the most tightly integrated data visualization 
solution for Visual Studio because of the great lengths taken to provide unobtrusive 
functionality within your environment. The Smart Tag Wizard exposes many 
properties within the design-time surface instead of launching external wizards. The 
Chart FX rendering engine utilizes AJAX to product fully interactive images and 
support state in web applications. Grid FX adds innovative design-time and run-time 
functionality with a myriad of developer tools such as design-time wizards, drag 
and drop grid elements (WYSIWYG), palettes and motifs (auto-include CSS), 
heirarchical API, enhanced Property Grid Editor, automatic web.config updates for 
settings, documentation and the Resource Center (dynamic samples with code). 
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Microsoft preaches security life cycle, 



< continued from page 1 

concern and then selecting an 
explanation for why they are 
opting out. The tool also pro- 
vides an advisory area that 
informs users when the model- 



ing process is finished. "People 
weren't often sure when the 
process was done," he said. 

"Microsoft's approach and 
new threat modeling tool make it 
easy for application developers 



to identify potential security 
issues without having to be secu- 
rity experts," said senior For- 
rester analyst Mike Gualtieri. "I 
like how the tool generates not 
only a list of potential security 



issues, but also explanations." 

"There is no good commer- 
cial tool that does this," 
observed Neil MacDonald, a 
Gartner fellow and vice presi- 
dent. "Microsoft created a wiz- 
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ard-type tool for threat model- 
ing. Even if you don't like 
Microsoft, the tool is useful." 

The threat modeling tool 
will become generally available 
in November, according to 
Steve Lipner, Microsoft's senior 
director of security engineering 
strategy. It will integrate with 
Visual Studio for the purpose of 
filing bugs and will be a free 
download, he said. 

A one-year pilot program, 
dubbed SDL Pro Network, will 
train security experts in tools and 
guidance associated with the 
SDL, said Lipner. Nine compa- 
nies in Europe and the United 
States are participating in the ini- 
tial program. Microsoft's goal is 
to scale the program for broader 
membership, he said. 

OPTIMIZATION MODEL 

To complement that effort, 
Microsoft is introducing a matu- 
rity model that it refers to as the 
SDL optimization model. It is 
designed to help organizations 
self-assess practices for secure 
development and to provide 
SDL Pro Network members 
with a standard framework for 
providing services, Lipner said. 

Microsoft has based the pro- 
gram on its existing infrastruc- 
ture optimization models (APO, 
BPIO and Core IO), according 
to the company. The SDL opti- 
mization model keys in on policy 
and organizational capabilities; 
requirements and design; imple- 
mentation; verification; and 
release and response. 

"Microsoft has talked about 
taking SDL external for a 
while," said Gartner's MacDon- 
ald. He noted that the programs 
are an expansion of the work its 
consulting and professional ser- 
vices have done already. 

"It makes great sense. We 
point to Microsoft as best in 
class in terms of incorporation 
of security into the develop- 
ment life cycle," MacDonald 
said, adding that many of 
Microsoft's customers struggle 
with how to modify processes, 
establish metrics and, most 
important, foster a culture that 
embraces security. He said that 
learning how Microsoft accom- 
plished those tasks would help 
organizations tackle cultural 
and political challenges that are 
often much greater than the 
technical hurdles they face. 

"We are asking customers to 
make [SDL] a priority," said 
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unveils SDL threat modeler 



Microsoft's Lipner. "We are 
making our SDL experience 
available to developer organiza- 
tions with the hope that they 
will reflect the lessons in code 
that they ship." 

ATTACKS STACK UP 

That commitment is important 
because attacks are moving up 
the stack from major operating 
systems and into the application 
layer, while Microsoft software 
is becoming more secure, he 
explained. 

MICROSOFT, OMG 
COME TOGETHER 

< continued from page 1 

analyst with Forrester Research, 
said of Microsoft. "In the end, 
Microsoft is nothing if not prac- 
tical, and joining OMG is a good 
business decision for them [that 
is] in keeping with other recent 
decisions, like becoming a spon- 
sor of the Apache foundation." 

He observed that Microsoft 
has a "good track record" of lis- 
tening to its developers and 
architects, and that .NET users 
have been explicit about their 
desire for better, standardized 
modeling tools. 

Microsoft's decision to join 
OMG, Hammond added, 
means the industry can move 
forward on modeling, instead 
of bogging down in debates 
over the usefulness of U ML vs. 
domain-specific languages or 
three-stage model-driven archi- 
tecture vs. N-stage MDD. A 
real need exists for a new gen- 
eration of easy-to-use modeling 
tools that take SO A, rich Inter- 
net applications and Web 2.0 
into account, he said. 

In a prepared statement, 
Bob Muglia, senior vice presi- 
dent for Microsoft's server and 
tools business, said modeling 
would be built into the compa- 
ny's application platform as a 
core element. He said Microsoft 
believes modeling will make IT 
more dynamic, helping business 
analysts, developers and systems 
architectures to work together 
more effectively to create and 
maintain applications. 

Microsoft has promised to 
take an active role in OMG 
working groups, saying it will 
assist with standards develop- 
ment and engage in open dialogs 
with the rest of the industry. I 



To prove its contention, 
Microsoft referred to data 
from the IBM X-Force 2007, 
2008 Security Report, which 
reveals that Microsoft's total 
share of disclosed vulnerabili- 



ties had fallen over the past 
year. Microsoft says that after 
adopting the SDL, there was a 
45% reduction in total vulnera- 
bilities one year after release 
between Windows XP and 



Windows Vista. 

The 2007 Microsoft Security 
Intelligence Report tallies 504 
major operating system vulnera- 
bilities found in 2006, compared 
with 6,099 for applications. 



"The responsibility for pro- 
ducing secure applications ulti- 
mately belongs in development," 
said Gartner's MacDonald. Ven- 
dors that treat it that way are on 
the right track, he said. 

"Think about security in 
requirements," MacDonald said. 
"That's what Microsoft is talk- 
ing about." I 
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Telerik RadControls for WinForms 

Classic Windows Forms controls, stunning WPF-like appeal 

Sometimes superior technology is easy to spot — it just stands out from the pack. The same applies for user 
interface components. Just take a look at Telerik RadControls for Windows Forms — built on top of familiar 
and time-tested technology, yet they are like nothing youVe seen before! Animations, scaling, rotation, 
transparencies, alpha blending, you name it! 



No, this is not WPF. It's what Windows Forms should be! Take a ride! 












www.telerik.com/HeadTurning 

US Sales: +1 .888.365.2779; Europe Sales: +359.2.80.99.850 



^ftelerik 



deliver more than expected 



Perforce The Fast Software Configuration Management System 




Perforce Technical Support 

Fast Turnarounds. Precise Answers. 



Our global support teams are always available to share their 
expertise in person - no scripted responses, answering services, 
or dispatch centers. At Perforce Software, our highly experienced 
technical support engineers take pride in providing fast 
turnarounds with precise answers. 

Keeping your projects on track requires a support team that is 
ready to help right when you need it. You can count on Perforce's 
Fast SCM System and legendary technical support to give you the 
winning advantage. 



Perforce 



SOFTWARE 



Download a free copy of Perforce, no questions asked, 

from www.perforce.com. Free technical support is available 
throughout your evaluation. 



All trademarks and registered trademarks are property of their respective owners. 
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Oracle Eclipses WebLogic 

New Enterprise Pack release 
spins integrations to suit server 



BY ALEX HANDY 

Oracle has released the Enterprise Pack 
for Eclipse, an integrated IDE tool set 
for users of WebLogic Server and Oracle 
Fusion Middleware. The Enterprise 
Pack includes many of the integrations 
and timesavers Oracle and BE A devel- 
oped over the years for interacting with 
Java application servers directly from 
the IDE, bundling them in a form com- 
patible with Oracle WebLogic Server 
lOg Release 3 for the first time since 
Ganymede's release. 

A major feature supported by the 
more recent version of WebLogic Server 
is Fast Swap. Originally inserted into 
WebLogic when BEA still numbered it 
version 10.3, FastSwap allows Java class- 
es to be redefined with no redeployment 
required. When a class is modified, this 



change-aware class loader can take on 
the new class without changing the state 
of the application as it continues to run. 

The Oracle Enterprise Pack for 
Eclipse includes many of the advances 
created by BEA and currently offered 
in what is now known as Oracle Work- 
shop for WebLogic Server. The Enter- 
prise Pack, however, is a separate set of 
plug-ins and modifications that can be 
installed on top of an existing user's 
copy of Eclipse. It includes plug-ins 
and helpers for dealing with WebLogic 
servers, databases and other Java EE 
applications from development through 
deployment. 

The Oracle Enterprise Pack for 
Eclipse can be downloaded for free at 
oracle.com/tools/enterprise-eclipse 
-pack.html. I 



Infragistics update supports JSF 1.2 



BY DAVID WORTHINGTON 

Catering to the needs of vertical enter- 
prises, a component maker has 
revamped its JavaServer Faces (JSF) 
grid control to function better as a 
spreadsheet and has ported its suite of 
controls to JSF 1.2. 

Infragistics' Net Advantage for JSF 
2008 Volume 2 adds cell activation to the 
Net Advantage Web Grid control, allow- 
ing users to focus on single cells within 
the grid and to shift the focus with key- 
board shortcut keys. The release pro- 
vides aggregate functions in column 
footers such as average, count, mini- 
mum, maximum and sum. 

Infragistics has bundled several pre- 
view versions of AJAX-enabled naviga- 
tion controls with Net Advantage. They 
include WebDropDown, a component 
that permits type-ahead data entry; 
WebTree Drag and Drop, which adds 
drag and drop features to the NetAdvan- 
tage WebTree component; and 
JavaScript event handling hooks that let 



developers call client-side JavaScript in 
response to user actions. 

Infragistics is supporting JSF 1.2 for 
the first time with this version of the 
product, said Dawn Colossi, director of 
public relations. As a consequence, 
developers can begin to deploy the com- 
ponents on popular Java frameworks, 
such as the Spring Framework. 

The release is priced at US$795, with 
source code included with every sub- 
scription. Infragistics charges a $495 fee 
for priority support. 

The company also announced 
Net Advantage Icons, a suite of icons 
that developers can use to add themat- 
ic graphics to user interfaces across 
all platforms for which they ship com- 
ponents. The icons are sold as theme 
packs that range from basic to line- 
of-business applications. Pricing starts 
at $149. 

Additional theme packs will intro- 
duced over the next year, according to 
Infragistics. I 



ADOBE, ZEND TEAM UP TO AID RIA DEVS 

BY ALEX HANDY 

As the company employing some of the 
brains directing PHP's growth, Zend 
hopes to bring Adobe's flashy develop- 
ment tools to bear on the world of rich 
Internet applications. At Zend's annual 
user conference, the two companies 
announced that the Action Message 
Format has been integrated into the 
open-source Zend Framework 1.6. 

Adobe's Action Message Format 
is designed to speed transfers of multi- 
media and other content between 



server and client. With Adobe's 
Flex running the front end of an RIA, 
Zend hopes developers will use its 
framework and PHP on the server side 
to handle the distribution of informa- 
tion and database elements to and from 
the client. 

The work between Adobe and Zend 
will extend to their respective Eclipse- 
based work environments. The compa- 
nies intend to bridge the gaps — and 
foster connectivity — between their 
Eclipse variants. I 



Production-Proven 
Distributed Caching 

Every day hundreds of millions of 
data caching operations are handled 
by ScaJeOut StateServer - routinely, 
seamlessly, and blazingly fast. 



i 



Linear scalability and high-availability 
are why ScaieOut StateServer has 
been selected for thousandsof 
production servers today, running 
under the most stressful loads. 

Whether you have a 2 server Web 
farm or an enterprise compute 
grid, let ScaieOut StateServer 
help you reach peak performance. 



ScaleOut 
StateServer 

Distributed Caching 
for . NET & Linux 
Farms & Grids 



'.!.' 




® ScaleOut Software 

www.scaleoutsoftware.com I tel. (503) 643-3422 
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Aptana acquires Python IDE 

BY JEFF FEINMAN The acquisition brings and services such as cloud each one into ] 



BY JEFF FEINMAN 

Open-source Web develop- 
ment software provider Aptana 
has coiled up with the Python 
programming language via its 
acquisition of Pydev, a Python 
and Jython IDE. 



The acquisition brings 
Aptana a popular Eclipse plug- 
in that offers code completion, 
refactoring, code analysis and 
debug features. Aptana execu- 
tives said the acquisition sets 
the stage for a full Python suite 



and services 
deployment. 

Aptana users can employ 
Aptana Studio and Pydev side 
by side, either by adding Pydev 
to the standalone edition of 
Aptana Studio or by plugging 



each one into Eclipse. Aptana 
Studio looks to ease Web devel- 
opment and deployment by 
integrating AJAX tooling with 
Aptana's Jaxer AJAX server, 
PHP and Ruby on Rails. 

Interest in Python has been 



Standard Edition 

$599 per developer, royalty free 

Professional Edition 

$1499 per developer, royalty free 
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increasing, especially after 
Google announced earlier this 
year that the Python language 
would be used for the Google 
App Engine, Aptana executives 
said. 

"This has been a great year 
for the Python developer com- 
munity, with the advent of great 
frameworks such as Django and 
deployment solutions such as 
Google App Engine," said Dion 
Almaer, an open- Web advocate 
for Google. "The tooling is get- 
ting better all the time. One of 
the great tools is Pydev, espe- 
cially if you are Eclipse-minded. 
Having Aptana take on Pydev 
means progress for that project 
and Python developers." 

Terms of the acquisition 
were not disclosed. I 

NEW API FOR RIA 
MINDS BUSINESS 

BY JEFF FEINMAN 

Managed Objects has created a 
platform-independent API that 
provides business service infor- 
mation to developers of rich 
Internet applications. 

Web 2.0 Connect provides 
access to Managed Objects' 
data model and analytics, com- 
pany executives said. The API 
can be used to build business 
service management views into 
products and platforms from 
such vendors as BMC Software 
and Hewlett-Packard. Abbas 
Haider Ali, Managed Objects' 
vice president of product strat- 
egy, said the company's internal 
framework translates perfor- 
mance data into an object-ori- 
ented service model. 

"If you want to build an 
application that has information 
about a server's performance 
history — when the server was 
commissioned, how many tick- 
ets have been opened on it, 
what's its performance summa- 
ry over the last three months — 
you can query that information 
using this API," Haider Ali said. 
"At the same time, you can 
push information into it." 

Web 2.0 Connect can work 
with any language that commu- 
nicates over HTTP and that can 
process XML and JavaScript 
Object Notation streams, 
according to the company. The 
product is based on a represen- 
tational state transfer (REST) 
architecture and can use proto- 
cols such as SOAP, the Google 
Web Toolkit RPC and Action 
Media Format, with developers 
mixing and matching the proto- 
cols, Managed Objects said. I 
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Atalasoft suite steers through SharePoint docs 



BY DAVID WORTHINGTON 

As SharePoint becomes an inte- 
gral part of the workflow and 
documents crowd repositories, 
the need will arise for better 
navigation. A document imag- 
ing component maker has 
developed a suite of produc- 
tivity applications for Share- 
Point in an effort to provide 
that missing functionality. 

Atalasoft announced its Vizit 
product suite at the Digital 
Management Solutions confer- 
ence in Cologne, Germany. Viz- 
it comprises Previewer, a free- 
ware add-on for SharePoint that 
gives thumbnail views of docu- 
ments within a repository; Vizit 
SP, a document editor and view- 
er; and Vizit Scan to SharePoint, 
a document scanning utility. 

Previewer opens thumbnail 
views of single- or multipage 
documents on mouse over, and 
the box moves down with users 
as they scroll through the reposi- 
tory. It supports Microsoft Word 
95 and above, including the 
Office Open XML format as well 
as PDF, said Rutherford Wilson, 
director of product management 

DEEPSEE DIVES INTO 
DATA IN REAL TIME 

BY DAVID WORTHINGTON 

An integration software maker 
has created a business intelli- 
gence product that embeds into 
transactional applications to pro- 
vide what it says are more action- 
able results than are obtainable 
with business intelligence suites 
that rely on data warehouses. 

InterSystems' DeepSee lets 
data be viewed in real time, 
rather than after the fact, to 
expedite decision making, said 
Paul Grabscheid, vice president 
of strategic planning. It runs on 
Linux, Mac OS X, OpenVMS, 
Unix and Windows, and inte- 
grates with C + + , Java and 
.NET applications. Pricing 
begins at US$6,000. 

The data model underpining 
DeepSee gives data elements 
people-friendly names and 
organizes elements into subject 
areas. Data is accessed in place 
and is embedded into applica- 
tion workflows. Java Database 
Connectivity and ODBC "con- 
nectors" let DeepSee pull data 
from external sources. 

DeepSee also provides an 
external reporting tool. Analyzer 
is a browser-based Web service 
for end users. I 



for the Vizit suite. 

Excel and PowerPoint sup- 
port is on the road map, he not- 
ed. A beta of Previewer is avail- 
able at the Atalasoft website. 

Vizit SP opens documents in 
another browser window for 



editing and viewing. Users can 
modify a document's layout and 
change document properties. 
Views include a thumbnail navi- 
gation of documents as well as 
an explorer view of the exact list 
within SharePoint in which the 



document is stored, said Wilson. 

A beta version of Vizit SP will 
be released this month. Pricing 
has not yet been determined. 

Vizit Scan to SharePoint, 
shipping now in beta, is a free 
application designed to simplify 



the workflow for getting elec- 
tronic copies of paper docu- 
ments into a SharePoint reposi- 
tory. Atalasoft partnered with 
Kodak to create a workflow in 
which documents are scanned 
directly into SharePoint. I 



Your best source for 
software development tools! 
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$ 800, 
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5-User Pack 
Paradise # 
T34 0208 

$ 1,4 14." 



.NET Edition 
Paradise # 
D77 01201A01 

$ 476." 



Paradise # 
SC5 03101A01 
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LEADT00LS Imaging Pro 

by LEAD Technologies 

Load, save and convert 1 50+ image formats 
including TIFF, EXIF and PDF, supporting many 
compressions. Acquire images from TWAIN or 
32/64bit WIA devices. Apply transforms, color 
space conversions and 200+ region aware 
image processing routines. Also includes high 
level display controls, thumbnail browser, pan 
window and imaging common dialogs. 
•.NET, API, C++ Class Libraries &WPF 
•AJAX and ASP.Net Web Form Controls 
•COMInteropwrapperfor.NET 

• Royalty Free 

programmers.com/lead 

DevTrack Small Team Edition 

Powerful Defect and Project Tracking 
by Tech Excel 

TechExcel DevTrack is the most powerful, 
affordable and easy-to-use defect and project 
tracking tool for development organizations. 
You'll dramatically transform your development 
processes, save significant time and resources, 
and deliver quality products on-time and 
on-budget. 

• Sophisticated workflow engine 

• Point-and-click administration 

• Fully configurable user interface 

programmers.com/techexcel 

NEW: IP*Works! Version 8 

by /n software 

The latest evolution of the most comprehensive 
suite of Internet communications components 
for professional developers is here! 

A leap forward in design, performance, and 
new functionality with support for every major 
Internet protocol including - FTP, HTTP, SMTP, 
POP, IMAP, LDAP, DNS, RSS, SMS, Jabber, 
SOAP, WebDav, REST, ATOM, RAS, XML, and 
many more! 

Call for pricing on the Java Edition 



programmers.com/nsoftware 

StorageCraft ShadowProtect 
IT Edition v3.x 

by StorageCraft 

Create, edit or restore backup images on as 
many servers, desktops and laptops as needed. ! 
Create online or cold state backups in minutes, 
no software installation required. StorageCraft™ 
ShadowProtect IT Edition provides complete 
bare metal recovery in minutes. ShadowProtect • 
IT Edition provides IT Professionals with a 
bootable Windows environment to create and 
restore compressed and encrypted backups, 
no software installation required. 



programmers.com/storagecraft 



800-445-7899 
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I dtSearch Engine for Win & .NET 

| Add dtSearch's "blazing speeds" 
| (CRN Test Center) searching and 
| file format support 
• • dozens of full-text and fielded 
data search options 

• file parsers/converters for hit-highlighted 
display of all popular file types 

• Spider supports dynamic and static web data; 
highlights hits with links, images, etc. intact 

• API supports .NET, C++, Java, SQL and more; 
new .NET Spider API 



i»fi 



"Bottom line: dtSearch manages a terabyte of 
text in a single index and returns results in 
less than a second. " — InfoWorld 



Single Server 

Paradise # 

D29 02101A07 

$ 949." 

programmers.com/dtsearch 



VMware Management 
& Automation Bundle 

VMware Virtual Datacenter 
I Automation is the first automation 
solution for the virtualized 
datacenter. It leverages the power 
of VMware Infrastructure to automate 
I the previously manual and error-prone 
processes of IT Service Delivery and 
Business Continuity. IT Service Delivery 
represents the entire lifecycle for managing 
application infrastructure — from request, to 
deployment and eventual decommissioning. 
Business Continuity is ensuring fast, reliable 
and manageable recovery from disasters. 



Paradise # 

F010131 

99 



$ 711. 



c-tree Plus® 

by FairCom 

With unparalleled performance and sophistication, 
c-tree Plus gives developers absolute control over 
their data management needs. Commercial 
developers use c-tree Plus for a wide 
variety of embedded, vertical market, 
and enterprise-wide database applications. 
Use any one or a combination of our flexible 
APIs including low-level and ISAM C APIs, simplified 
C and C++ database APIs, SQL, ODBC, or JDBC. 
c-tree Plus can be used to develop single-user and 
multi-user non-server applications or client-side 
application for FairCom's robust database server 
— the c-treeSQL™ Server. Windows to Mac to 
Unix all in one package. 

programmers.com/fi 

Altova® MapForce® 2008 

Visual Data Conversion, 
Transformation, and 
Integration Tool 
by Altova 

MapForce: The premier data mapping, 
conversion, and integration tool from 
the creators of XMLSpy®. Through 
its visual interface, users can map 
seamlessly between any combination 
of XML, database, flat file, EDI, and/or 
Web service, then convert data instantly 
or auto-generate an application for 
recurrent transformations. Languages for 
code generation include: XSLT 1.0/2.0, 
XQuery, Java, C++, and C#. 
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Enterprise Edition 

1 user 

Paradise # 

IOD03101A02 

$ 1,282." 
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Telerik RadControls 

by Telerik 

Add grid, combo, editing, navigation and charting 
functionality to your AJAX and ASP.NET projects. 
RadControls for ASP.NET enhances your Web 
applications by adding AJAX functionality to your 
ASP.NET projects. The suite takes full advantage 
of the features included in Visual Studio 2005. 
RadControls for ASP.NET helps developers deliver 
feature-rich, standards-compliant (WAI-A, WCAG 
1.0, XHTML 1.1) and cross-browser compatible 
Web applications, while significantly cutting 
their development time. RadControls for ASP.NET 
includes: RadEditor, RadTabstrip, Radlnput, 
RadCalendar, RadUpload, RadWindow, RadAjax, 
RadGrid, RadCombobox, RadMenu, RadSpell, 
RadChart, RadTreeview and more. 
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Single Developer 

Paradise # 

TB3 01101A01 

$ 648." 




Paradise # 
V55 61201C01 

$ 3,414." 

programmers.com/vmware 



TX Text Control 14 

Word Processing Components 

TX Text Control is royalty-free, 
robust and powerful word processing 
software in reusable component form, 

•. NET WinForms control for VB.NET and C# 

• ActiveX for VB6, Delphi, VBScript/HTML, ASP 

• File formats DOCX, DOC, RTF, HTML, XML, TXT 

• PDF export without additional 3rd party 
tools or printer drivers 

• Nested tables, headers & footers, text 
frames, bullets, numbered lists, multiple 
undo/redo, sections, merge fields 

• Ready-to-use toolbars and dialog boxes 



NET 
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Professional Edition 

Paradise # 

T79 02101A01 

$ 919." 



programmers.com/theimagingsource 



Enterprise Architect 7.1 

Visualize, Document and 
Control Your Software Project 
by Sparx Systems 

Enterprise Architect is a comprehensive, 
integrated UML 2.1 modeling suite 
providing key benefits at each stage of 
system development. Enterprise Architect 
7.1 supports UML, SysML, BPMN and 
other open standards to analyze, design, 
test and construct reliable, well under- 
stood systems. Additional plug-ins are 
also available for Zachman Framework, 
MODAF, DoDAF and TOGAF, and to 
integrate with Eclipse and Visual Studio 
2005/2008. 



Corporate Edition 

1 -4 Users 

Paradise # 

SP6 0001 

$ 196." 



programmers.com/sparxsystems 



Multi-Edit 2008 

by Multi Edit Software 

Multi-Edit 2008 delivers, a powerful IDE, 
with its speed, depth, and support for 
over 50 languages. Enhanced search 
functions include Perl 5 Regular 
Expressions and definable filters. 
Supports large DOS/Windows, UNIX, 
binary and Mac files. File Sync 
Integration for: Delphi 6, 7, 2005, 
C++Builder 6, BDS 2006 and RadStudio 
2007,VB6,VC6,VS2003&VS 
2005. Includes file compare, code 
beautifying, command maps, and 
much more. 



programmers.com/telerik 



1-49 User 
Paradise # 
A30 01201A02 

$ 161." 

programmers.com/multiedit 
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TotalView pushes Replay for bidirectional debugging 



BY JEFF FEINMAN 

TotalView Technologies has created a 
record and replay tool that lets develop- 
ers work backward as well as forward 
when debugging. 

ReplayEngine is a separately licensed 
add-on that integrates with the 
TotalView Debugger. It helps develop- 
ers find root causes of problems quickly 
through reverse execution, according to 
TotalView CEO Rich Collier. 

"[With] a lot of the debuggers that 
are out there, you have to debug going 
forward. [ReplayEngine] gives the 
developer the freedom to debug back- 
ward or forward," Collier said. "We 
believe that's a unique capability, espe- 
cially in the C/C++ and Fortran arena." 

Using ReplayEngine, developers can 
set watch points to see differences in 
data and source code through a record- 
ing. Collier said the typical method of 
debugging involves setting a breakpoint 
and frequently running past the actual 
error, which necessitates the setting of 
another breakpoint. ReplayEngine finds 
the root cause of a problem by starting 
from the point of failure, he said. 

ReplayEngine has a "run back to" com- 
mand that jumps backward longer dis- 
tances within the code. Developers com- 
pare any set of points along the captured 
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'Before' and 'after' views of TotalView's ReplayEngine, which offers replay functions and watch points to view differences in source code. 
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sequence to ease fault identification. 

"It enables you to step backward line 
by line, and it captures the program exe- 
cution," Collier said. "The record capa- 
bility creates an instrumentation library 
that allows the reproduction of any point 
in the program. It records the session, so 
you're able to start from any previous 
state and then replay the recorded ses- 
sion in a controlled fashion." 

Collier said ReplayEngine can help 
after a crash, when information needed 



to debug might be missing. TotalView's 
offering can help a developer code as it 
existed before the crash. During crash- 
es, there is often a wide gulf between 
the point of failure and the point where 
the error occurred, and ReplayEngine 
helps trace the error to its source. 

"ReplayEngine is exciting new tech- 
nology," said Paul Gray, education pro- 
gram chair of the Supercomputing Con- 
ference, which focuses on networking, 
storage and analysis. "From a software 



engineering perspective, being able to 
record and replay program execution 
will go a long way in improving the 
effectiveness of the troubleshooting 
phase of software development, which is 
a crucial component of high-perfor- 
mance computing education." 

Replay Engine is available on Linux 
x86 and x86-64. Developers can debug 
parallel applications using the MPICH 
2.0 Message Passing Interface library on 
x86 Linux platforms. I 



{Come together} 




ComponentOne Doc-To-Help® is the only tool that helps developers and writers work 
seamlessly together to create deliverables that include Help, printed manuals, reference 
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RIAs go beyond Flash-y Web design to challenge 



BY JENNIFER DEJONG 




nee just a way to 
spruce up static 
Web pages, RIA 
technology is 
moving into the 
realm of real 
applications. Two 
developments are 
driving the shift. 
First, rich Internet application frame- 
works such as Microsoft Silverlight and 
Sun Java FX let developers choose RIA 
tools tied to their respective .NET and 
Java development platforms. That offers 
alternatives to market leader Adobe 
Flash and its companion Flex offering, 
which some claim are geared more to 
designers than to developers. More 
important, it moves RIA technology 
beyond its roots as a separate, specialized 
approach, making it a set of capabilities 
within the development platform. 

Second, although RIA technology 
originated as a way to create a better 
online experience — adding such ele- 
ments as animation to previously static 
Web pages — it is emerging as a powerful 
way to create desktop applications 
designed to run offline and synchronize 
with data when connected to Web. "We 
call them rich Internet apps, but they 
will be used on the desktop, too," said 
Jacob Leherbaum, Sun senior product 
line manager for JavaFX. "Where the 
RIA is running doesn't really matter." 

New development frameworks may 
remake the RIA landscape in the long 
run, but thus far they have had little 
impact. Viewing RIA content on the Web 
requires a proper execution environ- 
ment — and the Flash player is "on peo- 
ple's machines," said Greg DeMichillie, 



director of product management for 
developer tools at Adobe. 

"Flash is consumed by 98% of Inter- 
net browsers," said ZapThink analyst 
Ron Schmelzer. It's not that other RIA 
development frameworks don't work, he 
said. "But at this point there is just much 
more Flash." 

Flash's installed base is its only advan- 
tage, said Patrick Hynds, president of 
.NET consultancy CriticalSites. From a 
developer's standpoint, Flash and its 
companion Flex (an abstraction layer 
that handles data access and other ser- 
vices) are difficult to program. "There is 
a lot of hack, a lot of heavy lifting, partic- 
ularly around tasks such as synchronizing 
audio and video," Hynds said. 

But developers who use Flash and 
Flex are likely to stick with those offer- 
ings for now. "People don't throw away 
their platform for a better tool 
overnight," said Hynds. 

Flash has the potential to create 



great things, said Microsoft director of 
rich client platforms Brad Becker, "but 
Flash development is a specialized skill." 
Flash is organized around frame rates, 
movie clips and other concepts that are 
likely to be more intuitive to designers 
than to developers, he said, so those who 
aren't designers find they "really have to 
develop in a bizarre way." 

Flash development is a niche market, 
Becker added, observing that many 
Flash developers come from the mar- 
keting and advertising worlds. "They are 
not object-oriented programmers." 

TEAM EFFORT 

Adobe's DeMichillie said RIA content 
creation is a joint undertaking between 
developers and designers. "Developers 
create applications that look better and 
work better, and that involves design- 
ers," he said. The combination of Flash 
and Flex offers "a complete stack." 
ZapThink's Schmelzer also argued 



that "Flex is appealing to developers," 
noting that while Flash originated in the 
design space, Flex did not. Adobe 
acquired Flex when it bought Macrome- 
dia in 2005, and "Macromedia had roots 
in the development world," Schmelzer 
said, citing the company's ColdFusion 
offering, a programming language for 
creating dynamic Web pages. 

Debate aside, RIA tools tied to the 
environment in which developers work 
every day offer them a different experi- 
ence from using Flash and Flex. "When 
you are using C# [in Silverlight], it's not 
about movie clips and timelines," said 
Becker, who worked for Macromedia 
before it was acquired by Adobe. 

The experience is different because 
Silverlight has hooks into .NET, added 
CriticalSites' Hynds. "You can write C# 
code. You can write VB.NET code." 

Similarly, Java FX runs on top of Java, 
said Sun's Leherbaum. "It's not a new 
platform." 



NOT ALL RIAs ARE ALIKE 



The three approaches for developing rich Internet appli- 
cations all have their benefits and associated trade-offs: 

• Browser-based solutions. Here, developers deliver rich 
Internet applications using a browser's document object 
model and scripting engine, along with AJAX frameworks. 
Browser-based RIAs install and execute automatically, as 
long as the client's browser has JavaScript enabled. The 
downside: Cross-browser support and testing can be a prob- 
lem, given the subtle implementation differences across 
browsers. 

• Player-based solutions. Using a browser plug-in as a com- 
mon runtime, developers can provide the same ability to run 
across operating systems as a browser-based solution 
offers, but without the guirks that individual browsers create 




for RIAs. This approach, used by Adobe's Flash and Flex and 
by Microsoft's Silverlight, minimizes cross-browser testing 
issues. But users may not be willing to update plug-ins or 
wait for a lengthy install process to complete if they don't 
already have the latest version. 

Desktop-based solutions. The third option is to install a set 
of runtime components on the desktop client outside of the 
browser's security constraints. Desktop-based solutions, 
including Adobe AIR and Sun Java FX, provide full access to 
local file systems and the ability to persist information, 
even when a Web connection is interrupted. They also add 
deployment and maintenance headaches. 

Source: "Rich Internet Apps Move Beyond the Browser, " by Jeffrey S. Hammond 
and Michael Goulde; Forrester Research, June 2007 
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Adam Calderon, a practice lead for .NET 
consultancy Interknowlogy, likes Silverlight 
because for the most part it looks and feels 
much like other Microsoft development offer- 
ings. "You get the total integration of all the 
tools [in one development suite]," he said. 

For example, Calderon said, the personal- 
ization preferences he specified in 
Microsoft's Web development offering 
ASP.NET can be applied in Silverlight: "I am 
Adam. I like a blue background, with these 
things on my home page." 

But some aspects of Silverlight are not 
fully baked, said Calderon. "There are some 
challenges around data binding. The 
approach is similar to that used in WPF, 
but it is not the same," he said, referring to 
Windows Presentation Foundation, the 
graphical subsystem in .NET 3.0. Sil- 
verlight currently is in release 1.0; 
Microsoft is expected to make Silverlight 
2.0 available this fall. 

PORTAL KILLER 

The real opportunity for RIA technology 
is not sprucing up Web sites, but "killing 
the corporate portal" and replacing it 
with RIA-based desktop applications, 
said ZapThink's Schmelzer. Corporate 
portals — basically collections of dis- 
parate information used by employ- 
ees — were supposed to make life easi- 
er. But many were inefficient, offering 
access only to sales leads, contacts and 
other data "you could have [stored] in 
Microsoft Outlook," he said. 

RIA-based desktop applications 
let employees access more timely 
sales data, for example, Schmelzer 
said. "What are other salespeople 
working on? What is this customer's 
continued on page 38 ► 
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RIAs move to the desktop 



< continued from page 37 

sales history? You don't want to 
be sitting in front of the cus- 
tomer without having any idea 
of what that customer just 
bought." RIA-based desktop 



apps essentially bridge client 
server and Web apps, he said. 

They also provide an oppor- 
tunity to interact with other 
applications, said DeMichillie, 
referring to Adobe's AIR offer- 



ing, which lets RIA technology 
run on the desktop. 

A key application for RIA is 
redoing the user interface of 
enterprise applications, said 
Microsoft's Becker. 'With legacy 



apps, the user interface is an 
afterthought. You need a way to 
book a flight or file an expense 
report that is not incredibly 
painful." Use of RIA technology 
for such applications introduces 
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new ways of delivering content" 
and "blurs the line between 
browser-based and desktop 
applications," Forrester Re- 
search analyst Jeffrey Hammond 
wrote in a June 2007 report 
titled "Rich Internet Apps Move 
Beyond the Browser." 

But to date, RIA technology 
has not been widely used, said 
CriticalSites' Hynds. "Unless 
the company is a dot-com doing 
Web 2.0 development, it's not 
that common." 

"We are at the beginning of 
this trend, not the end," said 
Adobes DeMichillie. But "it is 
rapidly growing, and we will see 
more and more of it." I 



RISK, SECURE 
YOUR RIA 



Application development profes- 
sionals make trade-offs between 
risk and reward every day, and they 
shouldn't view RIA delivery any dif- 
ferently. Before greenlighting an RIA 
project, make sure that you: 

• Prove that the expected return out- 
weighs the potential exposure. You 
(or your business sponsors) should be 
able to articulate the potential cost 
savings of deploying an RIA as well as 
the expected upside of increasing 
customer engagement (such as an 
improved conversion rate or higher 
average order size). Before you start 
to code, balance the upside against 
the worst-case costs that would 
result from exposing sensitive data or 
business processes. 

• Pick the low-hanging fruit. The 
costs associated with implementing 
communications-stream encryption 
are negligible compared with the 
cost of potentially exposing sensi- 
tive data. Therefore, the outlays for 
buying a code-scanning tool and 
training a developer to use it are 
money and time well spent. And 
while retrofitting an existing RIA 
may be a challenge, there's no 
excuse for starting a new one with- 
out using the lower-risk program- 
ming practices described above. 

• Reach out to your peers and get 
them involved. Reaching out to secu- 
rity and risk management profession- 
als is important, but those folks are 
not the only peers you should engage 
in the process. Enterprise architec- 
ture professionals, especially those 
in charge of your SOA strategy, also 
have a role to play in structuring the 
server side of the applications with 
which your RIA will integrate. 

Source: "Securing Rich Internet Applications," 

by Jeffrey S. Hammond with Mike Gilpin, 

Chenxi Wang and David D'Silva; Forrester 

Research, March 2008 
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FROM THE EDITORS 

Microsoft's timely UML move 

Eyebrows were raised when Microsoft released modeling tools as part 
of its Visual Studio 2005 Team System (VSTS). While it's certainly 
common for Microsoft to eschew industry standards for proprietary 
approaches, few had expected Redmond s "not invented here" syndrome 
to extend to the Unified Modeling Language. 

Yet, as this newspaper first reported in June 2004, the modeling tools 
in the Team Architect version of VSTS were based on the company's own 
notation, which was quite separate from UML. It wasn't just a subset; it 
was an implementation that reflected Microsoft's own idea of what devel- 
opers needed for modeling. 

Now, more than four years later, Microsoft has done an about-face: It 
has joined Object Management Group and will contribute to OMG's 
UML initiatives. While it's not clear how UML will be implemented in 
future Microsoft tools, or what will happen to Microsoft's own modeling 
notation, we can expect more UML, not less. 

Does that mean Microsoft was wrong to avoid UML in its original 
implementation of VSTS? Not at all. There was no culture of formal mod- 
eling in Microsoft's traditional customer base of smaller and mid-sized 
companies. Formal UML-based modeling was far too complex for that 
market segment and would have worked against the rapid application 
development that characterized .NET development. In 2004, Microsoft 
was right to introduce modeling but to hold back from embracing UML. 

Times have changed. UML is more streamlined, and the projects 
being constructed with .NET are larger. In 2008, Microsoft is right to 
join OMG, to take part in future work on UML development and to help 
its developers move to model-driven development. I 

Security in the life cycle 

It was no small challenge for Microsoft to make security an integral part 
of its software development life cycle; the company had to overcome a 
raft of cultural, political and technical obstacles. So its decision to share 
its know-how with customers should be a great help to enterprises that 
are struggling with those same problems. 

As we report in this issue, Microsoft has created programs that will 
eventually build an ecosystem around its security development life cycle 
(SDL). In doing so, Microsoft is securing its platforms down the stack, 
helping to assure information integrity and privacy for its customers. 

While it will take time for SDL know-how to trickle down from its pro- 
grams to its customers, Microsoft has also delivered a tool that is suitable 
for the security layperson. The SDL threat modeling tool takes knowl- 
edge that was once the domain of security experts and packages it in a 
context that developers can more easily understand. 

We believe the tool will be an asset to Microsoft shops that are begin- 
ning to take a hard look at software security, helping to demystify the top- 
ic. There is really nothing else like it out there, and Microsoft has once 
again demonstrated that its core competency is platforms and tools that 
people can understand. 

But SDL did not spring up overnight; Microsoft has been building out 
the programs for years. We have to ask why Microsoft did not bring the 
work to light sooner, because, according to its own data, malicious hack- 
ers have shifted their sights away from major operating systems and onto 
applications. Did Microsoft not see that coming? 

The internal build of the SDL threat modeler is version 3.0, and 
Microsoft created the tool all the way back in 1999. Packaging up the 
software today is akin to giving children Halloween candy for Christmas. 

Our griping aside, Microsoft has done a superb job adopting its SDL, 
and it has made a major public commitment to security. More important, 
the software giant is showing a commitment to its customers and to help- 
ing secure a part of its stack that is not strictly its responsibility. 

It is an extraordinary step, and Redmond has earned our praise for the 
initiative. I 



LETTERS TO THE EDITOR 

Straightening out .NET 



The key to getting .NET straightened 
out is for Microsoft, once and for all, to 
force its developers to eat their own dog 
food. With the exception of the OS and 
the framework itself, no product devel- 
opment should be done outside of the 
.NET framework. If there's a perfor- 
mance problem, fix the framework! 

.NET is a secondary concern to 
Microsoft. Make it Microsoft's bread and 
butter, and I think you'd see a pretty sig- 
nificant improvement in .NET. 

Chris Ruest 

VISUAL FOXPRO NOT DEAD YET 

The last word has not yet been had on 
Visual FoxPro; two separate efforts are 
under way by third-party vendors to port 
VFP to .NET. In one effort, eTecnologia 
is building the eponymous eTecnologia 
Compiler for .NET In another, Guineu, 
a FoxPro runtime, compiles already 
compiled VFP programs into CLR- 
based programs. 

VFP is tuned, through 20 years of use 
and development, to solving business 
problems. This provides a considerable 
edge in creating and maintaining busi- 
ness applications. The two efforts, which 
respectively should be complete in a 
year and two years from now, will likely 
make VFP the most efficient and effec- 
tive .NET language for business solution 
development. 

Hank Fay 

CTO 

DataWorks 

Thanks for your recent article about 
Visual FoxPro. 

Visual FoxPro isn't dead yet; there 
are, from what I hear, something like 
500,000 Visual FoxPro developers 
throughout the world. I love the product 
and almost refuse to use anything else. 
There are many VFP developers turning 
VFP into a super product; check out 
swfox.net. There is a huge following of 
VFP developers throughout South 
America. Other Web sites where anyone 
can check on VFP work are Russian site 
lafox.net; French site atoutfox.org; Ger- 
many's guineu.foxpert.com; U.S. -based 
whitelightcomputing.com and west- 
wind.com; and, in Canada, stonefield 
.com, working on a database enhance- 
ment tool for Visual FoxPro. 

These are only a few of the people 
and companies still developing software 
in Visual FoxPro. It is still alive, several 
years after some fool declared it dead. 

Cecil T. Champenois Jr. 

Information Systems Manager 

Irwindale, Calif. 



DEFINING BUSINESS ANALYST'S ROLE 

Your article "Business analysts struggle 
to reinvent role" (June 15, page 5) is 



very timely. The profession is indeed 
reinventing itself; better yet, the role of 
the business analyst is being formally 
shaped and defined. 

The International Institute of Busi- 
ness Analysis has made great strides 
toward a clearer definition of the busi- 
ness analyst's role. 

In addition, the entire business 
analysis industry, from training 
providers such as ESI to resource 
providers such as ModernAnalyst.com, 
is taking an active role in shaping the 
business analysis landscape. 

Adrian Marchis 

Modern Analyst Media LLC 

Editors note: The author is the publishing 
editor of ModernAnalyst.com, a resource 
portal for business analysis. 

SCRUM SNAKE OIL 

I have problems with Steve Gordon's let- 
ter in the July 1 issue concerning testing 
practices in Scrum/agile development 
("Testing in Scrum," page 37). 

While Mr. Gordon offers a clarifica- 
tion as to how testing should occur in a 
Scrum/agile regimen, I and other soft- 
ware testing colleagues have yet to see 
that sort of "pure" scenario develop at 
any large company in which 
Scrum/agile has been forced on the 
workers by inept management listening 
to well-paid consultants. 

In my opinion, the agile propo- 
nents — who inevitably turn out to be 
software developers, Scrum/agile 
"coaches" and, more often than not, 
"consultants" — are selling snake oil. 

Where are the software testers to 
vouch for Mr. Gordon's "pure" scenario, 
particularly testers working for Fortune 
500 companies? I would like to see Mr. 
Gordon pull them out of a hat. I don't 
think they exist. 

There is no perfect way to perform 
software development and testing, 
though the Scrum/agile folks would 
lead you to believe otherwise. There 
are different ways to accomplish that 
task successfully. 

Usually, the effort involves hiring 
an actual manager with a track record 
of success rather than some night 
school MBA bean counter. Most big 
companies are lazy, however, and hire 
the bean counters. 

Al Gibson 

Round Rock, Texas 

WHAT DO YOU THINK? 

SD Times welcomes feedback. Letters 
should include the writer's name, com- 
pany affiliation and contact informa- 
tion. Letters become the property of 
BZ Media and may be edited for space 
and style. Send your thoughts to 
feedback@bzmedia.com. 
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Lowdown on visualization hype 



Picture a circle of children holding 
hands on a grassy hill. One wavering 
voice starts to sing, and soon the entire 
circle joins in, filling the air with the 
strains of "Kumbaya." 

That's the feeling you get when some- 
one says "virtualization" in a crowd of IT 
folks. Vacuous smiles break out as the 
conversation turns from serious talk 
about business requirements to 
platitudes about virtualization s 
benefits. Rarely does anyone 
mention the issues virtualiza- 
tion creates or the processes 
required to manage a highly 
virtualized environment. 

Virtualization is a great 
tool, but the industry buzz 
makes it sound as if virtualiza- 
tion is the entire toolbox. 
Frankly, if all you have is a 
hammer, everything looks like a nail — 
and these days all the nails seem to sport 
"Virtualize me" signs. Many of them 
should not be virtualized. But that 
doesn't matter any more than it mat- 
tered in the heady days of XML that not 
every bit of data is best expressed as text. 

Is virtualization good for eliminating 
hardware dependencies? Yes, in many 
cases. Running a VM of an operating 
system that you don't otherwise support 
is a handy way to make old software run 
on new hardware. Is it a good way to 
merge all of those not-too-busy servers 
you installed in the days when Larry 
Ellison was admonishing you not to fall 
for the "lots of little boxes" solutions? 
Yes. Having 20 machines sitting around 
at 10% utilization is wasteful at best. 

Is virtualization the right tool for 
every job? Was the wheel? 

There are so many problems that vir- 
tualization cannot solve (or should not 
be used to solve) that we need to let the 
hype cycle run its course and get on with 
the business of IT. 

If your solution needs to be load-bal- 
anced, for example, virtualization is the 
worst solution, unless you've got a 
process in place to guarantee that no two 
load-balanced instances will end up on 
the same box (since having two load-bal- 
anced instances on the same virtual serv- 
er just creates more overhead, in the 
form of context switches and resource 
allocation/contention). Even then, if your 
application is so busy that it requires load 
balancing, why are you putting it onto vir- 
tualized servers with other applications? 

Then there's the "all of your eggs in 
one basket" scenario. Employees at one 
consulting firm have told me their entire 
infrastructure is a single virtualized 
server that pretends to be all things to all 
people. That's got "fail" written all over it. 
A single point of failure becomes a mas- 
sive corporate meltdown pretty quickly. 
Hardware is cheap enough that the firm 
should have at least a couple of servers so 




it can get back up quickly in the event of 
a system catastrophe. But these days, the 
buzz says they don't need the hard- 
ware — they're virtualized! 

And server virtualization is the most 
useful of the virtualization technologies. 
Let us not forget that for a very long 
time, storage area network vendors have 
been trying to sell customers what 
amounts to LUN (logical 
unit) virtualization, and for 
the most part customers 
have said, "No thanks." Fun- 
ny thing: When you have 
block-based storage and a 
vendor says, "You don't have 
to worry about where a giv- 
en block is stored, because 
our box takes care of it for 
you," customers still want to 
JlifJ/ know where to find their 
data should the box go down. The 
answer usually is, "You can't know; our 
box hides that from you!" End of SAN 
virtualization. 

Some vendors look to alleviate cus- 
tomer concerns about SAN virtualiza- 
tion by offering services or tools to let 
them get the data off the virtual server if 
the device goes bad. But then customers 
ask, "What if I want to remove your 
device?" Traditionally the answer has 
been an implied, "You're on your own." 
Once again, end of SAN virtualization. 

Network-attached storage virtualiza- 
tion in the form of unified directories is 
somewhat better; at least you can get at 
the data without going through the vir- 
tualization device. Some of the older 
products still rename things on the way 
through, but the industry did learn long 
ago that renaming creates headaches. 

Still, the case for putting all of your 
corporate data in one directory tree is a 



little weak. It does enable portability in 
some cases, but it's no panacea. When a 
vendor tells me its products ease admin- 
istration, I respond, "I used to have one 
directory structure for this data; now I 
have two. This is easier . . . how?" 

Heterogeneous solutions require 
more hardware, and this is where file- 
level virtualization loses the race to serv- 
er virtualization. The benefit of server 
virtualization is obvious; promise to 
merge three physical servers into one, 
and the densest IT admin will scurry to 
pay you. Not so for file virtualization, 
where the sales line is, "Put in this box, 
and the world will be a prettier place!" 
It's a much harder sell to convince peo- 
ple that a unified directory structure will 
save them money, when they'll have 
more hardware to maintain. 

As for desktop virtualization, politics 
is the only other arena in which some- 
one can draw cheers by saying, "It'll be 
less efficient, it'll cost you more, it'll be 
less adaptable, but it's the right thing to 
do\" With desktop virtualization, you'll 
be spending the same amount on lap- 
tops and desktops (they have to run the 
same applications, after all); your net- 
work will see a ton more traffic while 
entire images are transferred; and your 
servers will store virtual desktop images, 
increasing their hardware requirements. 
Since a laptop solves "Get access any- 
where and have the same desktop" 
requirements, why, exactly, do we need 
desktop virtualization? 

Not that I begrudge the virtualization 
vendors their successes; there's some 
great stuff out there. But I shake my 
head when our industry gleefully over- 
reacts to new technologies that promise 
the stars, and sets budgets based on 
what's hot instead of what's needed. I 

Don MacVittie is a strategic architect 
for F5 Networks' DevCentral developer 
network. 



Dell leads pack in server 
shipment growth 



DATA WATCH 



Dell was the only vendor among the server segment's top five market-share leaders to grow 
year-over-year shipments by a double-digit rate in the second quarter, posting a 24.2% 
increase over Q2 2007, according to Gartner Research. Hewlett-Packard, however, shipped 
the most servers overall in both guarters. Here's the breakdown: 
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Calculating the cost of SOA 



I get the same question over and over 
again: How much will my SOA cost? 

There are so many things wrong with 
that question that I don't even like to 
respond, because it's the classic IT geek 
response: It depends. It depends on the 
number of services, if they exist; the cost 
of externalization; and the cost of the 
application development or process- 
ing/orchestration layers. Oh, yeah — we 
also need to understand your business 
and the core problems that exist there 
before we get started. The list goes on, 
and you can't figure out the true cost of 
a SOA until you've figured out these 
things first. 

Moreover, SOA is architecture and 
thus should transcend a single project, 
so it's tough to narrow down the cost of 
a SOA to a single instance of incremen- 
tal work. Perhaps the better question is: 
What will I probably spend for my 
instance, and how does that work into a 
larger strategic plan? Confusing, I know, 
but follow me here. 

Truth be told, you can't cost out a 
SOA like a construction project; there 
are many dynamic elements to SOA that 
make an exact estimation, without much 
supporting data, difficult. Let's face it, 
we've not done many of these at this 
point, thus the data is simply not there to 



support the metrics. However, here are 
some very "general" guidelines to follow: 
The problem that I see over and over 
again is that cost estimates are provided 
without a clear understanding of the 
work needed to be done. Indeed, you 
need to budget some time to create the 
budget. This means understanding the 
domain in detail, including: 

• Number of data elements 

• Complexity of data 
storage technology 

• System complexity 

• Service complexity 

• Process complexity 

• New services needed 

• Enabling technology 

• Applicable standards 

• Potential risks 

Typically, this formula is expressed as: 
Cost of SOA = (Cost of Data Complexity 
+ Cost of Service Complexity + Cost of 
Process Complexity + Cost of Enabling 
Technology Solution) 

For instance, calculate the cost of 
data complexity as: 

Cost of Data Complexity = (((Number 
of Data Elements) x Complexity of the 
Data Storage Technology) x Labor Units) 
where the number of data elements is 




the number of semantics you're tracking 
in your domain, new or derived, and the 
complexity of the data storage technolo- 
gy is expressed as a percentage between 
and 1 (0% to 100%). For instance, rela- 
tional technology would be 0.3, object- 
oriented technology 0.6 and ISAM 0.8. 
So, at US$100 per labor unit, or the 
amount of money it takes to 
understand and refine one 
data element, we could have: 
Cost of Data Complexity = 
(((3,000) x .8) x $100) 

The calculated cost of com- 
plexity would be $240,000— 
the amount of money needed 
to understand and refine the 
data so it fits into your SOA 
(which is a small part of the 
overall project, by the way). 
If you get this, you can get the rest of 
the cost analysis procedure; simply apply 
the same notions to the cost of service 
complexity, the cost of process complex- 
ity and the cost of the enabling technol- 
ogy solution. 

Some things to remember: 
1. These are not really metrics (func- 
tion points), because we really don't have 
historical data to abstract here. In 
essence, you need to use your own project 
management and project costing meth- 



ods; just apply them to this new approach, 
using the formulas I'm suggesting above. 

2. Count on 10% to 20% variation in 
cost, for the simple reason that we've not 
walked down this road before. As we 
move from project to project, we'll get 
better at costing out SOA. 

3. Make sure you dial in at least two 
major mistakes, such as selecting the 
wrong vendor or hiring the wrong archi- 
tect. You may encounter more, but 
almost never fewer. 

4. Make sure to change cost estimates 
as scope creep occurs (and it always does). 
The nice thing about using formulas such 
as the ones I'm expressing here is that, as 
change occurs, you can quickly see the 
effect on the budget. Moreover, as change 
occurs later in the SOA projects, the cost 
of change goes up exponentially. 

I feel sorry for those who are tasked 
with coming up with cost estimates for a 
SOA project. I would put it into the 
experimentation category for the first 
few instances, so that overruns won't get 
as much pushback from management. 

Indeed, SOA needs to prove itself to 
the stakeholders — and they are very 
sensitive about the ROI aspect of the 
approach. You should consider the 
notion of ROI within your cost esti- 
mates. But that's a topic for another 
column. 

Reach analyst David S. Linthicum at 
david@linthicumgroup. com. 
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your infrastructure. 
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Rules of the rock star gambit 



J i^k dding manpower to a late software 
^^project makes it later," is Brooks' 
Law, and I've quoted it approvingly in this 
column before. Adding people burdens 
infrastructure, introduces training issues 
and requires increased communication. 

In a previous column ("Differences 
in Programmer Productivity," Feb. 15, 
page 37), I argued that one should con- 
centrate not on finding elite developers 
but on avoiding terrible ones. Although 
there's little peer-reviewed data on the 
topic, experience suggests the very best 
programmers are a small multiple better 
than average, while the very worst pro- 
grammers are a large multiple worse. 
Therefore, to increase your team's aver- 
age productivity rapidly, you shouldn't so 
much be seeking superstars as carefully 
avoiding (and firing) underperformers. 

Brooks' Law and my programmer- 
productivity argument make consulting 
difficult. When management comes to 
the painful decision that it has to shell out 
money for a consultant, most of the time 
it's primed to expect the consultant to say, 
"We're going to supplement or replace 
your entire staff with the same number or 
more of our [more expensive] associates." 

So I guess I should say that Brooks' 
Law and my programmer-productivity 
maxim make consulting easier but make 



honest consulting harder. 

Often, one of the first things an hon- 
est consultant does is break the harsh 
news that the gap between what is 
expected and what is possible is too great 
to bridge in the (undoubtedly short) time 
left before "must launch." Frequently, 
the next step is to concentrate not on the 
development team, but on 
management expectations. 

There are rare occasions, 
however, when it makes sense 
for a team to put its hopes on 
the shoulders of a single, 
skilled developer — an ap- 
proach I call the rock star gam- 
bit. The three critical compo- 
nents are a very talented devel- 
oper, a very short time frame 
and no domain discovery. 

The rock star gambit is a bet on a 
person, not a technology. Mediocre 
developers will often agitate for a tech- 
nology-based gambit late in a troubled 
project. Such a tactic is suicidal. Ask 
yourself, "If this person is troubled with 
our existing tools, with which they are 
familiar, does it make sense that they 
will become much more productive 
using a new, unfamiliar tool?" 

The rock star gambit requires a legiti- 
mately above-average developer — some- 



Windows &. NET Watch 




one who'll be able to work rapidly and 
independently. Rock stars might use a 
nonstandard technology or tool set, but 
they must be familiar with it and confi- 
dent they can use it to achieve the very 
high level of productivity required. 
Above-average developers know crunch 
time is not the time for risking incompat- 
ibilities or learning the corner 
cases of a technology. 

Even great developers 
move toward the mean over 
time. Exceptional productivity 
may require selective neglect 
of important matters — coding 
standards, team communica- 
tions, expense reports, sleep. 
One can let that debt accumu- 
late for two or three weeks 
without creating a mess. Any 
longer, and the mess starts to tangle new 
development. Further, there's only so 
much information any single person, no 
matter how talented, can retain; go 
beyond that level (say, several thousand 
lines of new code), and software develop- 
ment slows down. 

Finally, the rock star must have that 
rarest of software development situa- 
tions: a precisely defined statement of 
work. I've known rock star programmers 
who could look at the ceiling and rattle 
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off assembly language routines that 
removed stalls, but I've never known a 
rock star requirements analyst who can 
get 20 yes-or-no answers from account- 
ing in an hour-long meeting. The techni- 
cal debt accumulated by a rock star 
might include an incomplete object 
model — one that satisfies the immediate 
need, but is not yet flexible enough to be 
rapidly changed. And it only takes two or 
three "Need an answer ASAP" e-mail 
messages to undermine the momentum 
of the best rock star. 

It's best if the rock star is working on 
a single, cohesive, loosely coupled mod- 
ule; but I've also seen the rock star gam- 
bit succeed in chewing through a backlog 
of minor bugs, touching a huge number 
of files in a small amount of time. 

The rock star gambit is superficially 
similar to a prototype or "spike" effort, 
which also typically involves an individ- 
ual, or at most a very small team, and a 
relaxation of normal development stan- 
dards. But a prototype will not have a 
precisely defined statement of work; it's 
an essentially exploratory task. 

You build a prototype with the expec- 
tation of throwing it away. You risk the 
rock star gambit when you're prepared 
to throw away the existing module or 
component. I 

Larry O'Brien is a technology consul- 
tant, analyst and writer. Read his hlog at 
www. knowing, net. 



Remember good tools at low cost? 



I've wanted to write a column for a long 
time about the myriad little software 
packages I use to make my life easier. 
Like most readers of this column, I sus- 
pect, I rely on lots of small, elegant util- 
ities that take care of a task in a simple, 
efficient manner. I am a big fan of these 
"applets" — which would be the better 
term were it not already hijacked by oth- 
er well-known technologies. 

Once a chosen applet migrates into 
my permanent inventory of tools, I 
always send a contribution to the 
author — either the expected fee or, in 
the case of free software, a donation. A 
fun wiki would be the list of people's top 
10 such utilities for, say, encryption, to- 
do lists, contact management, video 
viewing and the like. The list for soft- 
ware dev would include such items as 
Web page designers, test tools, reporting 
tools, project dashboards, defect identi- 
fiers, defect trackers and CI servers. 
Invariably, we would all discover that 
our prized to-do list manager, for exam- 
ple, is far inferior to another one we've 
never heard of. 

In days of yore, most software devel- 
opment tools fit in one category: They 
were comparatively inexpensive and 
were sold by many small, specialized 
vendors. Articles such as "C compiler 
shootouts" were regular (and highly 



awaited) features of such magazines 
such as Computer Language and, to a 
lesser extent, Dr. Dobb's Journal. 

Today, of course, tools are either free 
or terribly expensive; there is little mid- 
dle ground. And there are very few small 
vendors of tools, with the notable excep- 
tion of the components market for Win- 
dows applications — but those are more 
libraries than pure tools. 

One vendor that has perse- 
vered making great niche 
tools at remarkably approach- 
able prices is Altova, which 
has put out a variety of inter- 
esting products for a long 
time. Its flagship product, 
XMLSpy, is the standard-set- 
ter for XML file editing. It 
facilitates editing using a vari- 
ety of display formats; vali- 
dates documents via schemas and 
DTDs; has built-in editors, debuggers 
and profilers for XSLT and XQuery; and 
offers the ability to access most major 
databases, parse OOXML files, and gen- 
erate Java, C# and C++ code for XML 
manipulation. XMLSpy starts at US$149 
and, depending on features, can reach 
$1,200. A steal. 

Another major Altova package is Map- 
Force, a visual (and command-line) envi- 
ronment for file conversion. You can map 
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input records (XML, CSV, 
OOXML and WSDL definitions, among 
others) to new layouts and indicate what 
transformations need to be performed as 
the fields are resequenced into the new 
data formats. The visual interface allows 
you to drag and drop transformations 
from a bundled library and test the out- 
put in a sandbox environment that sup- 
ports output validation. And to 
avoid relying on XSLT trans- 
formations done quasi-inter- 
pretive ly, MapForce gener- 
ates code in C++, C# and Java 
that can use standard libraries 
such as MSXML or Xerces 
and integrate with leading 
IDEs. MapForce starts at 
$299 and runs to $1,200, 
depending on the feature set. 
UModel, the final entry 
among Altova's major products, is a 
UML modeling environment. Whereas 
typical IDE -bundled UML tools cover 
the basic five or so diagrams, UModel 
supports all 13 UML 2.1 diagrams plus 
Business Process Modeling Notation. It 
enables code generation in Java, C# and 
Visual Basic, with full support for bidi- 
rectional (diagram to code, code to dia- 
gram) synchronization. It can export the 
diagrams in EMF and .png formats and 
generate basic documentation using 



them. Pricing is similar to that for the 
previously discussed packages. 

Altova offers other products that fill 
smaller niches. Three of them are Style- 
Vision, which transforms XML into 
reports and documents via a GUI; Data- 
baseSpy, which interacts directly with 
any standard DBMS and lets you edit 
and transform fields, edit SQL, and 
import and export data — all visually; and 
DiffDog, my favorite diff utility, which 
can show changes in a file without being 
confused by its structure. For example, 
it can suppress comparisons of white 
space or tag prefixes. You can edit a file 
while running diff, and it will highlight 
differences in real time. And finally, you 
can run DiffDog on entire directories 
(for text, XML and binary comparisons). 

Getting back to the pricing, I've 
explained the generally favorable 
terms, but in fact they're better than I 
stated. For the price of any two prod- 
ucts at the enterprise level (a total of 
just under $2,000) or two at the profes- 
sional level (totaling just under $1,000), 
you can get all eight Altova products. 
So, they are even less expensive than 
they appear. 

Altova brings back the days of high- 
quality, niche solutions at great price — 
an aspect of the tool market that has 
been missing for far too long. I 

Andrew Binstock is the principal analyst 
at Pacific Data Works. Read his hlog at 
binstock. hlogspot. com. 
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WITH EVERYONE SCREAMING 

about cloud computing these days, I'm 
really impressed with VMware's new 
road map. My friends all call me brain- 
washed and remain curmudgeonly, call- 
ing cloud the new SO A: Everyone's got a 
cloud product now, and most of them 
seem fairly useless or nebulous. 

But in my opinion, VMware hit the 
nail right on the head with is Virtual 
Datacenter Operating System. Why rent 
time on someone else's cloud when you 
can buy an operating system that can 
run and manage thousands of systems all 
at once? The road map also shows a 
future where external and internal 
clouds can be synchronized, something 
users of Amazon's Web Services will be 
happy to hear about; AWS took a nose- 
dive in August, resulting in time lost for 
all those hosted on the service. 

When the day comes when a downed 
Amazon cloud can be replaced in 
moments with an internally hosted one, 
we will have reached the future. 

— Alex Handy 

BY NOW, MANY OF US HAVE seen 
the Microsoft commercial with Jerry 
Seinfeld and Bill Gates, and the majori- 
ty of folks who have seen it are wonder- 
ing why it was made. 

The commercial basically has Sein- 
feld meet Gates in a shoe store, with 
meaningless dialogue ensuing. There's a 
reference to a conquistador and talk of 
a computer 
I that can be 
eaten like a 
cake, but the 
one thing the 
commercial 
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is missing is humor. You know, the type 
of humor Jerry was able to give us for 
over 10 years on his show. But for what- 
ever reason, that whole humor thing 
seemed to elude Jerry in this one- 
minute commercial. 

Jerry, we know you haven't done 
much since your show went off the air a 
decade ago, aside from that animated 
movie about bees. Nevertheless, could- 
n't you have given us at little bit of the 
old Seinfeld, as in, "What's the deal 
with Vista?" — Jeff Feinman 

SO I FINALLY CAVED into my con 
sumerist impulses and purchased a 
16GB iPhone when my BlackBerry went 
on the fritz. The iPhone was out of con- 
tract and cost me 
much more than a I 
new BlackBerry 1 

would have. 

After a few days with 
the iPhone, my cognitive 
dissonance faded away. It is 
an outstanding device, and I use it as my 
primary business telephone. It was also 
far easier to set up my corporate e-mail. 
The prototype BlackBerry Bold that I 
saw at a trade show a few months back 
did not impress me all that much. 

The iPhone may not have the best 
hardware, but insofar as the user experi- 
ence goes, Apple has made another 
slam-dunk. — David Worthington 

IS IT JUST ME, OR HAS everyone you 
know created a Facebook page this week? 
I've been on Facebook for close to a 
year, mostly to try to monitor what my 
teenagers are doing online at 3 o'clock in 
the morning. But lately, my e-mail inbox 





has been filled with 
"friend" requests from 
current and former 
work colleagues, and 
from people I haven't 
seen nor spoken to in 
literally 30 years. 

After posting to a 
couple of friends' walls 
and waiting days for a 
reply, I've learned that 
Facebook isn't about 
conversations; it's about 
people putting their 
lives on display for their 
invitation-only circle of 
friends to view and perhaps comment 
on. Even if I haven't wondered what 
kind of day a former co-worker is hav- 
ing, that "status" will automatically pop 
up on my Facebook home page, so I am 
informed even when I wasn't curious. 

And some people scream "Look at 
me!" by updating their personal statuses 
every five minutes with the most mun- 
dane occurrences — "Jane is eating oat- 
meal and watching Regis." Do I need to 
know this? These are the same people 
who write those lengthy Christmastime 
letters letting you know their kids 
learned to ride a horse at camp this sum- 
mer, and they got new aluminum siding 
in the fall, and Mom passed a kidney 
stone. If I knew you well enough — or 
cared — I'd ask about those things. 

But one thing the technology has done 
is to make us choose sides, if even unwit- 
tingly. Do you post photos and update 
your status frequently, or do you simply 
watch the activity of others? In other 
words, are you a narcissist or a voyeur? 
— David Rubinstein 



business Briefs 




Hewlett-Packard will cut approximately 24,600 jobs, about 
7.5% of its workforce, as part of its integration with Electronic 
Data Systems (EDS), an IT services company. The job cut is 
expected to take place over three years, and half of the restruc- 
turing will be in the United States. HP completed its US$13.9 mil- 
lion takeover of EDS in August. EDS has approximately 142,000 
employees, and Mark Hurd, HP's CEO, said he is confident the 
integration of the two companies will go well . . . Microsoft will 
sell Greenfield Online's Internet survey division to ZM Capital, 
only weeks after it had reached an agreement to acguire the divi- 
sion. Microsoft's acquisition of Greenfield and the handoff to ZM 
Capital's ZM Surveys are expected to happen simultaneously in 
the fourth quarter of this year. Microsoft is acquiring Greenfield 
for US$486 million, but financial terms of the ZM Capital deal 
were not disclosed . . . Red Hat announced plans to acquire 
Qumranet, a provider of virtualization products. Qumranet 
employees will be folded into Red Hat. Executives of the open- 
source software provider said the acquisition of Qumranet will 
increase its goal of implementing virtualization technology into 
every system, from servers to desktops . . . Infosys Technolo- 
gies, an IT and consulting firm, announced plans to acquire U.K.- 
based SAP consulting company Axon Group for US$753 million. 
Axon provides consultancy services to organizations using the 



SAP strategic enterprise platform, and Infosys executives said 
the acquisition will increase its market opportunities with large 
businesses. The deal is expected to be complete by November 
. . . IBM had a 33.2% revenue share in worldwide server revenue 
in the second quarter, holding a 5.8 percentage point lead over 
second-place Hewlett-Packard, according to an IDC second- 
quarter report. Similarly, Gartner's second-quarter worldwide 
server report showed IBM with a 31.2% revenue share, a 3.6- 
point lead over HP . . . Tableau Software, a provider of analytics 
and visualization software, secured US$10 million in series B 
funding from New Enterprise Associates (NEA). Tableau execu- 
tives said the funding will go toward the development of new 
products and the expansion of sales channels. NEA previously 
invested $5 million in Tableau in 2004 . . . Adobe announced 
plans to acquire YaWah, a Denmark-based dynamic imaging soft- 
ware provider. Adobe executives said the acquisition will help the 
European expansion of Adobe Scene7, a rich media platform for 
e-commerce companies. Terms of the deal were not disclosed 
. . . Quest Software, a provider of application and database man- 
agement products, will acquire NetPro, a provider of Microsoft 
infrastructure optimization products, for US$78.7 million. Quest 
executives said the acquisition will allow Quest to extend its 
product portfolio into Microsoft infrastructure management. 



Events Calendar 



Embedded Linux October 1-3 

Developers Conference 

San Francisco 
MONTAVISTA 

www.mvista.com/vision 



VSLive Las Vegas 

Las Vegas 
1105 MEDIA 

vslive.com/lasvegas 



October 13-17 



OOPSLA 

Nashville, Tenn. 
ACM SIGPLAN 

www.oopsla.org 



October 19-23 



AJAXWorld 

San Jose 
SYS-CON 

ajaxsecuritybootcamp.sys-con.com 



October 20 



TechExcel Users 
Conference 

San Francisco 
TECHEXCEL 

www.techexcel.com/conference 



October 20-22 



iPhone Developer 
Summit 

San Jose 
SYS-CON 

www.iphonedevsummit.com 



October 21-22 



Embedded Systems October 26-30 
Conference 

Boston 
CMP MEDIA 

www.cmp-egevents.com/escb 

Microsoft Professional October 27-30 
Developers Conference 

Los Angeles 
MICROSOFT 

www.microsoft.com/pdc 



SD Best Practices 

Boston 

THINK SERVICES 

www.sdbestpractices.com 



October 27-30 



EclipseWorld 2008 

Reston, Va. 
BZ MEDIA 

www.eclipseworld.net 



October 28-30 



Software Business October 30-31 
2008 

San Francisco 

WEBC0M COMMUNICATIONS 

www.softwarebusinessonline.com/sb_conf08_index 



Dreamforce Global 
Gathering 

San Francisco 
SALESF0RCE.COM 

www.salesforce.com/dreamforce 



November 2-5 



ApacheCon 

New Orleans 

APACHE SOFTWARE FOUNDATION 

us.apachecon.com 



November 3-7 



WinHEC 

Los Angeles 
MICROSOFT 

www.microsoft.com/winhec 



November 5-7 



DevConnections 
Fall 2008 

Las Vegas 
PENT0N MEDIA 

www.devconnections.com 



November 10-13 



For a more complete calendar of U.S. software 
development events, see www.sdtimes.com/calendar. 
Information is subject to change. Send news about 
upcoming events to events@bzmedia.com. 
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Work with InterSystems. 




Software for connectivity and speed. 



If you want the highest performance from connected 
systems, work with InterSystems Ensemble® software. 

This rapid integration platform has a technology stack 
that includes the world's fastest object database - 
InterSystems Cache®. Cache's lightning speed, massive 
scalability, advanced object technology, and rapid devel- 
opment environment give the Ensemble platform un- 
matched capabilities. Ensemble users who have switched 
from other integration products report they can create 
integrated solutions in half the time, and their message 
processing is twice as fast. 



In addition, end-to-end management is vastly 
simplified because the embedded Cache database 
provides a repository for every message generated, and 
for the current state of every business process. Thanks to 
its robust database engine, Ensemble messages are never 
lost, and an interrupted business process can always 
restart from the point of interruption. 

For 30 years, we've been a creative technology partner 
for leading enterprises that rely on the high performance of 
our products. Ensemble and Cache are so reliable that the 
world's best hospitals use them for life-or-death systems. 



ImterSystems 



See product demonstrations at InterSystems.com/Connect5JJ 
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The integrated solution for defect tracking, test management and automated testing 



DevTrack 

Use DevTrack to track defects/issues 



Track each issue through a definable 

workflow 

SCM integration - track fixes against their 

source code deliverables 

Deploy a resolution across multiple 
releases, versions and products 
Reporting and metrics to illustrate the 
entire defect lifecycle 



DevTest 

Use DevTest to manage your testing 

• Create a central repository for your test 

cases, knowledge items and automation 
scripts 

■ Schedule releases and test cycles using a 
wizard-driven interface 

* Execute test assignments and submit 
defeats from the same interface 

■ Track results with real-time dashboards 
and reports 



TestLink 

Use TestLink to automate your testing 



Add automated tests to the DevTest 

test library 
r Schedule automated tests along with 

manual tests 
■ Launch automated tests from the 

DevTest Interface 
- Track automation results with 

real-time dashboards and reports 



TechExeel 

www.tectiexcel.com I 1-800-439-7782 



